CVE-2026-35243
Privilege Escalation in Oracle ADF Faces Leading to Full Compromise
Publication date: 2026-04-21
Last updated on: 2026-04-24
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | application_development_framework | 12.2.1.4.0 |
| oracle | application_development_framework | 14.1.2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Application Development Framework (ADF) product, specifically in the ADF Faces component of Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by a low privileged attacker who has logon access to the infrastructure where Oracle ADF runs. Successful exploitation can lead to a complete takeover of the Oracle ADF.
How can this vulnerability impact me? :
The impact of this vulnerability is significant as it allows an attacker with low privileges to compromise Oracle Application Development Framework (ADF). This can result in a full takeover of the ADF environment, affecting confidentiality, integrity, and availability of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a low privileged attacker with logon access to compromise the Oracle Application Development Framework (ADF), potentially leading to a complete takeover of the framework.
Successful exploitation impacts confidentiality, integrity, and availability, which are critical aspects in compliance with standards such as GDPR and HIPAA.
However, the provided information does not explicitly describe how this vulnerability affects compliance with specific regulations like GDPR or HIPAA.