CVE-2026-46772 Overview
CVE-2026-46772 affects the Oracle Application Development Framework (ADF) component of Oracle Fusion Middleware, specifically the ADF Faces module. The flaw enables a high-privileged attacker with local logon access to the infrastructure running ADF to compromise the framework. Successful exploitation can result in unauthorized access to all ADF-accessible data and unauthorized modification of a subset of that data. The vulnerability is categorized under CWE-284: Improper Access Control. Oracle disclosed the issue in the Critical Security Patch Update for June 2026.
Critical Impact
A locally authenticated, high-privileged attacker can read all ADF-accessible data and modify portions of it, breaching the confidentiality and integrity of Oracle Fusion Middleware deployments.
Affected Products
- Oracle Application Development Framework (ADF) version 12.2.1.4.0
- Oracle Application Development Framework (ADF) version 14.1.2.0.0
- Component: ADF Faces (Oracle Fusion Middleware)
Discovery Timeline
- 2026-06-17 - CVE-2026-46772 published to NVD
- 2026-06-17 - Last updated in NVD database
- June 2026 - Oracle published the Critical Security Patch Update (CSPU) for June 2026
Technical Details for CVE-2026-46772
Vulnerability Analysis
The vulnerability resides in the ADF Faces component of the Oracle Application Development Framework, a Java-based framework used to build enterprise web applications on Oracle Fusion Middleware. The flaw is an improper access control issue [CWE-284] that allows a high-privileged actor with local logon to the host running ADF to bypass intended access restrictions.
Exploitation is rated difficult and requires the attacker to already hold elevated privileges on the underlying infrastructure. Once these preconditions are met, the attacker can interact with ADF in a manner that exposes data and permits limited write operations. No user interaction is required, and the scope remains unchanged on the targeted component.
The EPSS score is 0.121%, reflecting a low predicted probability of in-the-wild exploitation at the time of publication. Oracle has not reported active exploitation, and the issue is not listed in the CISA KEV catalog.
Root Cause
The root cause is improper access control inside the ADF Faces component. Authorization checks do not adequately restrict what a locally authenticated, high-privileged operator can access or modify within ADF's runtime data surface. As a result, intended boundaries between administrative roles and application data are not enforced consistently.
Attack Vector
The attack vector is local. An adversary must first obtain logon access to the server infrastructure where ADF executes and must already hold high privileges on that host. From this position, the attacker interacts with ADF directly to read confidential data and perform unauthorized inserts, updates, or deletes against a subset of ADF data. No network exposure or victim interaction is required.
No public proof-of-concept exploit is available. Refer to the Oracle Security Alert CSPU June 2026 for vendor-supplied technical details.
Detection Methods for CVE-2026-46772
Indicators of Compromise
- Unexpected interactive or service-account logons to Oracle Fusion Middleware hosts running ADF, particularly outside maintenance windows.
- Anomalous read or write operations against ADF-managed data stores originating from administrative accounts.
- Modifications to ADF Faces configuration files or deployed application artifacts without a corresponding change ticket.
Detection Strategies
- Audit privileged session activity on Fusion Middleware hosts and correlate against authorized change records.
- Monitor Oracle WebLogic and ADF application logs for atypical data access patterns by privileged users.
- Enable database-level auditing on backends fronted by ADF to flag bulk read or modification activity tied to ADF service accounts.
Monitoring Recommendations
- Forward Fusion Middleware host logs, WebLogic logs, and OS authentication events to a centralized analytics platform for correlation.
- Alert on privilege escalation attempts and on use of administrative ADF endpoints from interactive sessions.
- Baseline normal behavior of ADF service accounts and trigger detections on deviations in data volume accessed or modified.
How to Mitigate CVE-2026-46772
Immediate Actions Required
- Apply the fixes published in the Oracle Critical Security Patch Update for June 2026 to all affected ADF deployments.
- Inventory Fusion Middleware environments to identify hosts running ADF 12.2.1.4.0 or 14.1.2.0.0.
- Review and reduce the population of accounts holding high privileges on hosts running ADF.
Patch Information
Oracle addressed CVE-2026-46772 in the June 2026 Critical Security Patch Update. Administrators should consult the Oracle Security Alert CSPU June 2026 advisory for patch identifiers, version-specific guidance, and prerequisite components. Apply patches in a staged, tested manner across non-production and production environments.
Workarounds
- Restrict logon access to Fusion Middleware infrastructure to a minimal set of named administrators with multi-factor authentication.
- Enforce least-privilege role assignments within ADF and the underlying operating system to limit who can reach the vulnerable code path.
- Segment ADF hosts on dedicated administrative networks and prohibit interactive logons from general-purpose workstations until patching is complete.
# Configuration example
# Identify users with interactive logon on an ADF host (Linux)
last -F | awk '{print $1}' | sort -u
# Restrict SSH access to an administrative group only
# /etc/ssh/sshd_config
AllowGroups adf-admins
PermitRootLogin no
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
