CVE-2022-21445Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

9.8 CRITICALEPSS 62.47%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 04:26 UTC

OverviewCVSS details

9.8CRITICALCVSS 3.1

Score source: oracle (CNA)
NVD status: Analyzed
Published: Apr 19, 2022
Assigner: oracle

Affected

Application Development Framework (ADF) (Oracle Corporation)

Versions: 12.2.1.3.0 · 12.2.1.4.0

Exploitation

Public exploit: None listed
CISA KEV: Listed · Sep 18, 2024
KEV due date: Oct 9, 2024
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 8

62.47%chance of exploitation in 30 days

Higher than 99.19% of CVEs

CVSS 3.1 · oracle (CNA)

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 2.0 · NVD

7.5High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack vector: Network
Attack complexity: Low
Authentication: None
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1oracle (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5	HIGH	2.0NVD	AV:N/AC:L/Au:N/C:P/I:P/A:P

CISA required action

⚡ Known exploited · remediation due Oct 9, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2022-21445
Status: Analyzed
Assigner (CNA): oracle
Published: Apr 19, 2022
Last modified: 2026-06-17 04:26 UTC
Weaknesses: CWE-502

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 13:13 UTC.