CVE-2022-21445

Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

Oracle — ADF Faces

Added to KEV catalog: 18 September 2024
Federal remediation due date: 9 October 2024
Weakness classification (CWE): CWE-502

CISA Description

Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.oracle.com/security-alerts/cpuapr2022.html ; https://nvd.nist.gov/vuln/detail/CVE-2022-21445

View on NVD View on MITRE CVE View full CISA catalog

More Oracle Vulnerabilities

CVE-2026-46817

Oracle E-Business Suite Improper Privilege Management Vulnerability

CVE-2026-35273

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

CVE-2024-21182

Oracle WebLogic Server Unspecified Vulnerability

CVE-2025-61757

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

CVE-2025-61884

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services