CVE-2026-35243: Oracle ADF Privilege Escalation Flaw

CVE-2026-35243 Overview

CVE-2026-35243 is a privilege escalation vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware, specifically affecting the ADF Faces component. This vulnerability allows a low-privileged attacker with local access to the infrastructure where Oracle ADF executes to fully compromise the application framework.

The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the application fails to properly restrict access to critical resources or functionality. An attacker with local system access can exploit this weakness to gain complete control over the Oracle ADF instance, potentially affecting all applications built on this framework.

Critical Impact

Successful exploitation enables complete takeover of Oracle Application Development Framework, affecting confidentiality, integrity, and availability of all dependent applications and data.

Affected Products

• Oracle Application Development Framework (ADF) version 12.2.1.4.0
• Oracle Application Development Framework (ADF) version 14.1.2.0.0
• Oracle Fusion Middleware environments utilizing ADF Faces component

Discovery Timeline

• April 21, 2026 - CVE-2026-35243 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35243

Vulnerability Analysis

This vulnerability exists within the ADF Faces component of Oracle Application Development Framework. The improper access control weakness allows an authenticated local user with minimal privileges to escalate their access to fully compromise the ADF installation.

The local attack vector requires the attacker to have existing logon access to the infrastructure hosting the Oracle ADF environment. Once this prerequisite is met, exploitation is straightforward with no user interaction required. The vulnerability affects core functionality within the ADF Faces component, which handles the user interface layer for Oracle ADF applications.

Oracle Fusion Middleware serves as the backbone for numerous enterprise applications, making this vulnerability particularly concerning for organizations running affected versions. A compromised ADF instance could provide an attacker with access to sensitive business data, the ability to modify application behavior, and the potential to disrupt critical business operations.

Root Cause

The root cause is classified as CWE-284 (Improper Access Control). The ADF Faces component fails to adequately verify authorization before allowing certain operations, enabling a low-privileged local user to perform actions that should require elevated permissions. This access control gap allows privilege escalation from a basic authenticated user to full administrative control over the framework.

Attack Vector

The attack requires local access to the system where Oracle ADF is installed. An attacker must first establish a foothold on the target infrastructure with valid credentials, even if those credentials only provide minimal access rights.

Once local access is obtained, the attacker can exploit the improper access control in the ADF Faces component to elevate privileges. The attack does not require any user interaction and has low complexity, making it reliable and repeatable once the initial access requirement is met.

The local nature of this attack means that organizations with strong perimeter security may still be vulnerable if an attacker gains initial access through other means such as phishing, compromised credentials, or insider threats.

Detection Methods for CVE-2026-35243

Indicators of Compromise

• Unexpected privilege changes or role assignments within Oracle ADF administrative functions
• Unusual local process activity associated with ADF Faces component execution
• Authentication logs showing low-privileged accounts accessing high-privilege ADF resources
• Anomalous file system access patterns within the Oracle Fusion Middleware installation directories

Detection Strategies

• Monitor authentication and authorization events within Oracle ADF for privilege escalation patterns
• Implement file integrity monitoring on Oracle Fusion Middleware installation directories
• Configure audit logging for all administrative actions within the ADF framework
• Deploy endpoint detection and response (EDR) solutions to identify suspicious local activity on middleware servers

Monitoring Recommendations

• Enable detailed audit logging for the ADF Faces component and review logs regularly
• Establish baselines for normal user behavior and alert on deviations indicating potential privilege abuse
• Monitor system calls and process creation events on hosts running Oracle ADF
• Integrate Oracle Fusion Middleware logs with SIEM solutions for centralized threat detection

How to Mitigate CVE-2026-35243

Immediate Actions Required

• Apply the security patches provided in the Oracle Critical Patch Update April 2026 immediately
• Audit all user accounts with local access to Oracle ADF infrastructure and enforce least privilege principles
• Review and restrict local access permissions to servers hosting Oracle Fusion Middleware
• Implement additional monitoring for any systems that cannot be immediately patched

Patch Information

Oracle has addressed this vulnerability in the April 2026 Critical Patch Update. Organizations should apply the relevant patches for their affected versions (12.2.1.4.0 or 14.1.2.0.0) as documented in the Oracle Critical Patch Update Advisory. Follow Oracle's standard patching procedures for Fusion Middleware, including testing in non-production environments before production deployment.

Workarounds

• Restrict local logon access to Oracle ADF infrastructure to only essential personnel and service accounts
• Implement network segmentation to isolate Fusion Middleware servers from general user workstations
• Enable enhanced auditing and monitoring on affected systems until patches can be applied
• Consider implementing application-level access controls to limit functionality available to low-privileged users

# Review local users with access to Oracle ADF servers
# Example commands for access audit on Linux systems

# List all users with shell access
cat /etc/passwd | grep -v nologin | grep -v /bin/false

# Review sudo permissions for middleware directories
grep -r "oracle\|fusion\|adf" /etc/sudoers /etc/sudoers.d/

# Check file permissions on ADF installation
ls -la $ORACLE_HOME/adf/