Oracle Application Testing Suite CVE-2026-35287

Exploitation requires network TCP reachability to an Oracle Application Testing Suite 13.3.0.1 instance and nothing more - no authentication, no user interaction, and no non-default feature per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable' rating. What limits real-world risk is deployment exposure rather than technical prerequisites: OATS is an internal QA/testing platform, so attackers must first reach the server, which for most organizations means being on the internal network or hitting a misconfigured internet-facing instance. The single confirmed affected version is 13.3.0.1; other versions are not listed in the provided data.

The CVSS 3.1 base score is 7.5 (High) driven entirely by confidentiality (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): network-reachable, low complexity, no privileges, and no user interaction, which Oracle characterizes as 'easily exploitable.' That makes it attractive on paper, but no EPSS score, no SSVC decision, and no POC were supplied, and it is not in CISA KEV - so there is no evidence of active or automatable exploitation despite the easy-exploit rating. The realistic priority is moderate-to-high for internet-exposed OATS instances (data theft with no auth) but lower for the typical deployment, since OATS is an internal QA/testing tool rarely exposed to the public internet. Note the vendor 'Authentication Bypass' tag is consistent with the PR:N vector; no signals conflict, but the absence of EPSS/KEV data means exploitation likelihood is unquantified rather than confirmed-low.

An attacker who can reach the OATS server over TCP sends crafted requests to a protected endpoint and, exploiting the authentication bypass, retrieves sensitive test data, credentials, or configuration without logging in. Because AV:N/AC:L/PR:N/UI:N, this requires only network connectivity and no valid account or victim interaction. No public POC has been identified, so exploitation would currently require original research.