Actively exploited in the wild
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
Oracle - ADF Faces · Listed in the CISA KEV since 2024-09-18. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2022-21445
CriticalCVSS 9.8KEVSummary
Vulnerability in Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces) in versions 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise ADF, potentially leading to takeover. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
Risk Assessment
An attacker can fully take over an application based on Oracle ADF, potentially leading to data confidentiality, integrity, and availability compromise.
Recommendation
Apply patches as per Oracle Fusion Middleware Patch Advisor and update Oracle ADF to a patched version.
Other vulnerabilities in Oracle Application Development Framework (ADF)
See all- CVE-2026-46772Medium
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with access to the infrastructure to compromise ADF, potentially leading to unauthorized access to critical data.
- CVE-2026-46771Medium
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A high-privileged attacker with access to the infrastructure can compromise ADF, leading to unauthorized access to critical data.
- CVE-2026-46770Medium
Vulnerability in Oracle Application Development Framework (ADF) in Oracle Fusion Middleware allows unauthenticated attacker with network access via HTTP to compromise ADF. Successful attacks require human interaction and may significantly impact additional products.
- CVE-2026-46769High
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware allows a high privileged attacker with network access via HTTP to compromise ADF. Affects versions 12.2.1.4.0 and 14.1.2.0.0.
Original NVD description (English source)
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).