CVE-2026-46772: Medium severity Oracle Oracle Application Development Framework (ADF) vulnerability
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Application Development Framework (ADF) executes to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Development Framework (ADF) accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Development Framework (ADF) accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict and harden logon access on the infrastructure hosts where Oracle ADF executes: disable or remove shared/high-privilege accounts, ensure only necessary high-privilege users can log on, and enforce strong authentication for those accounts.
Oracle Application Development Framework (ADF) administrative/logon access to ADF hosts = restricted to a minimal set of trusted administrators - Compensating control
Restrict network access to servers hosting Oracle ADF using firewall rules, ACLs or network segmentation (limit management/administrative access to trusted IP ranges and isolate ADF servers on a management network).
- Operational
Review and reduce privileges for accounts that can log on to the infrastructure hosting ADF (apply principle of least privilege); remove unnecessary high-privilege accounts.
- Operational
Audit logs and monitor for signs of unauthorized access or unauthorized update/insert/delete activity against ADF-accessible data; if compromise is suspected, rotate credentials for affected accounts and perform an incident response investigation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46772?
The severity of CVE-2026-46772 is medium with a CVSS score of 4.7.
How do I fix CVE-2026-46772?
To fix CVE-2026-46772, upgrade to the patched versions of Oracle ADF specified in the security advisory.
What systems are affected by CVE-2026-46772?
CVE-2026-46772 affects Oracle Application Development Framework versions 12.2.1.4.0 and 14.1.2.0.0.
What type of attacker can exploit CVE-2026-46772?
CVE-2026-46772 can be exploited by high privileged attackers who have logged on to the infrastructure.
Is CVE-2026-46772 difficult to exploit?
Yes, CVE-2026-46772 is considered a difficult to exploit vulnerability.