CVE-2022-21445

Oracle ADF Faces, the user-interface component of Oracle Application Development Framework (ADF) within Oracle Fusion Middleware, is vulnerable to deserialization of untrusted data (CWE-502) in versions 12.2.1.3.0 and 12.2.1.4.0. The flaw is easily exploitable: an unauthenticated attacker with network access sends malicious serialized data over HTTP, requiring no credentials, privileges, or user interaction. Successful attacks can result in takeover of the ADF deployment, with high confidentiality, integrity, and availability impacts reflected in the critical CVSS 3.1 score of 9.8. Organizations running ADF-based applications, typically built with Oracle JDeveloper and deployed as part of Oracle Fusion Middleware, are affected on the listed versions. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2024-09-18, confirming exploitation in the wild; EPSS assigns a 62.5% probability of exploitation within 30 days (99th percentile), while public PoC code and ransomware association are not documented.

What to do: Inventory Oracle Fusion Middleware and JDeveloper-built deployments for ADF Faces versions 12.2.1.3.0 and 12.2.1.4.0 and apply the current Oracle Critical Patch Update as directed by the Fusion Middleware Patch Advisor. Prioritize internet-exposed ADF applications given confirmed in-the-wild exploitation, and per the CISA KEV required action, apply vendor mitigations or discontinue use if mitigations are unavailable. Until patched, restrict HTTP access to ADF Faces endpoints.