Threats affecting pkg:maven/com.oracle.adf/adf

CVE-2026-46772 is a vulnerability in Oracle Application Development Framework (ADF) versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with access to the infrastructure where ADF runs to compromise the framework, potentially gaining unauthorized access to critical data and limited unauthorized modification capabilities. The vulnerability is rated medium severity with a CVSS score of 4.7. Oracle has released a Critical Security Patch Update in June 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply these patches promptly to mitigate risk.

CVE-2026-46771 is a vulnerability in Oracle Application Development Framework (ADF) versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with logon access to the infrastructure where ADF runs to compromise the framework. Successful exploitation can lead to unauthorized access to critical or all data accessible through ADF. The vulnerability has a medium severity with a CVSS 3.1 base score of 4.1, primarily impacting confidentiality. No official patch or fix is explicitly confirmed in the advisory, but Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks.

CVE-2026-46770 is a medium severity vulnerability in Oracle Application Development Framework (ADF) versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. Successful exploitation requires human interaction from a user other than the attacker and can impact additional Oracle products beyond ADF. The vulnerability affects confidentiality and integrity but not availability. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly stated a specific patch or fix for these exact versions in the provided advisory content. Oracle strongly recommends applying the June 2026 Critical Security Patch Update and following mitigation guidance to reduce risk until patches are applied.

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Development Framework (ADF) executes to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).