CVE-2026-35243

OVERVIEW CVE-2026-35243 is a local privilege escalation vulnerability affecting Oracle Application Development Framework (ADF) Faces, a component within Oracle Fusion Middleware. The vulnerability impacts ADF versions 12.2.1.4.0 and 14.1.2.0.0, allowing attackers with local access to the infrastructure to achieve complete system compromise. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) and requires low privilege access with an easily exploitable attack vector. The local attack vector (AV:L) combined with low attack complexity (AC:L) and low privilege requirements (PR:L) indicates that any authenticated user on the system can trigger the flaw without user interaction. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the ADF instance. EXPLOITATION STATUS Currently, there is no evidence of active exploitation. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and maintains an inactive status on threat tracking lists. The EPSS score of 0.00012 indicates minimal probability of exploitation in the wild, suggesting this remains a lower-priority threat from an immediate exploitation perspective. However, organizations running the affected ADF versions should still prioritize patching given the high severity rating and low exploitation barrier for local attackers.