CVE-2026-46769: Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Shared Components)

Synopsis

A full-takeover vulnerability affects the ADF Shared Components of Oracle Application Development Framework (ADF) versions 12.2.1.4.0 and 14.1.2.0.0, part of Oracle Fusion Middleware. An attacker with an admin-level account can reach the vulnerable component over HTTP from the network and exploit it without any victim interaction. Successful exploitation gives the attacker complete control over the ADF instance, including full read, write, and denial-of-service capabilities. No fix version has been published yet; HarborGuard tracks the Oracle advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the ADF HTTP endpoint over the network; local or physical access alone is not sufficient.

• AuthenticationRequired

  An admin or otherwise high-privileged account is needed to authenticate before the vulnerability can be triggered.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates entirely on their own once authenticated.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special memory-layout requirements to satisfy.

Blast Radius

• A successful attacker reads all data accessible to the ADF application, including stored credentials, session tokens, and application configuration.
• The attacker can write or overwrite application data, configuration files, and any persistent state the ADF instance manages.
• The attacker can crash or render the ADF service fully unavailable, disrupting any workflows or downstream systems that depend on it.
• The combination of high confidentiality, integrity, and availability impact means the attacker achieves effective takeover of the ADF instance and everything it hosts.