Oracle Application Development Framework vulnerabilities

7 CVEs affecting Oracle Application Development Framework, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46772, published 2026-06-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-21445: Oracle ADF Faces Deserialization of Untrusted Data Vulnerability, published 2022-04-19. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-09-18. EPSS: 62.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0.…
CVE-2019-2899, published 2019-10-16. Low severity, CVSS 2.4. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Supported versions that are affected are 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0 and 12.2.1.3.0. Easily…
CVE-2026-46769, published 2026-06-17. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are affected are 12.2.1.4.0 and …
CVE-2026-46770, published 2026-06-17. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and …
CVE-2026-35243, published 2026-04-21. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0.…
CVE-2026-46771, published 2026-06-17. Medium severity, CVSS 4.1. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Java Business Objects). Supported versions that are affected are 12.2.1.4.0 and …
CVE-2026-46772, published 2026-06-17. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0.…