Critical Remote Code Execution in Oracle ADF Faces (CVE-2022-21445) Deserialization Flaw
What It Is – Oracle ADF Faces, shipped with Oracle JDeveloper, contains a deserialization of untrusted data flaw that allows an unauthenticated attacker to execute arbitrary code on the host.
Exploitability – Public proof‑of‑concept code exists; the vulnerability is rated CVSS 3.1 9.8 (Critical).
Affected Products – Oracle ADF Faces library (part of Oracle JDeveloper Distribution) used in custom Java EE applications and Oracle Fusion Middleware deployments.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a secure development and code‑review control that validates input handling and prevents unsafe deserialization.
- Highlights gaps in vulnerability‑management processes; continuous monitoring and timely patch evidence are essential for audit readiness.
- Provides a concrete test of the control objective “Maintain a defensible evidence trail for remediation of identified software flaws,” which maps to multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Recommended Actions
- Inventory all applications that embed Oracle ADF Faces and verify version numbers.
- Apply Oracle’s security patch for CVE‑2022‑21445 immediately; if patching is not feasible, implement runtime mitigations (e.g., deserialization guards, input validation libraries).
- Update your vulnerability‑management workflow to capture patch‑deployment evidence as part of continuous control monitoring.
- Conduct a control‑mapping review to ensure the “secure development” and “vulnerability remediation” objectives are documented and auditable.
Source: CISA KEV – CVE‑2022‑21445