Executive brief
A vulnerability exists in the Oracle Application Development Framework (ADF), a tool used by developers to build enterprise applications. An unauthenticated attacker could trick a user into performing an action that allows the attacker to view, add, or modify sensitive data within the application. This could lead to unauthorized data manipulation or the exposure of private information.
Technical details
This vulnerability is classified as an improper access control issue (CWE-284) within the Security Framework component of Oracle ADF. It is exploitable over the network via HTTP without authentication, though it requires a victim to perform a specific action (User Interaction: Required). The exploit involves a scope change (S:C), meaning the impact can extend beyond the ADF framework to other integrated products. Successful exploitation allows an attacker to perform unauthorized CRUD (Create, Read, Update, Delete) operations on a subset of the data accessible to the framework. Affected versions include 12.2.1.4.0 and 14.1.2.0.0.
Affected products
- Oracle Application Development Framework (ADF) 12.2.1.4.0, 14.1.2.0.0
Timeline
- 2026-06-17: disclosed: Initial disclosure by Oracle
- 2026-06-17: advisory: NVD record published