What is the CVSS score of CVE-2026-35287?

CVE-2026-35287 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Application Testing Suite are affected by CVE-2026-35287?

Oracle Application Testing Suite 13.3.0.1 contains an unauthenticated authentication bypass enabling remote attackers to read all application data accessible to the product without providing…

How to fix or mitigate CVE-2026-35287?

Within 24 hours, conduct network asset discovery and inventory to identify all systems running Oracle Application Testing Suite 13.3.0.1; classify data sensitivity of affected instances. Within 7 days, implement firewall rules restricting network access to this product to isolated administrative networks only, enable comprehensive logging of all connection attempts, and disable the Application Testing Suite service if it is not actively required for business operations. Within 30 days, continuously monitor Oracle's security advisories for patch availability and establish a change management plan for immediate deployment to all affected systems once a patched version is released.

Oracle Application Testing Suite CVE-2026-35287

EUVD-2026-46456 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-jpv7-65rj-h3qm

Authentication Bypass Oracle Oracle Application Testing Suite Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network authentication bypass (AV:N/AC:L/PR:N/UI:N) yielding full read of accessible data (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:08 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 7.5

DescriptionCVE.org

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP network access read critical application data, potentially gaining complete access to all data reachable by the product. The flaw is tagged as an authentication bypass and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is confined to confidentiality - integrity and availability are unaffected per the CVSS vector.

Technical ContextAI

Oracle Application Testing Suite (OATS) is Oracle's web-based load, functional, and test-management platform (OpenScript, Oracle Load Testing, Oracle Test Manager) typically deployed on WebLogic and exposed over HTTP/TCP. The single CPE, cpe:2.3:a:oracle_corporation:oracle_application_testing_suite:*, confirms the affected component is the OATS application server itself. Oracle assigns no formal CWE (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with a confidentiality-only impact points to a broken-access-control / missing-authentication class weakness (conceptually CWE-287/CWE-306) that exposes protected data without valid credentials rather than a memory-safety or injection bug.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory, though Oracle CPUs deliver a cumulative patch rather than a distinct fixed product version, so no independently confirmed fix version string is available beyond the CPU bundle for 13.3.0.1. Until the CPU is applied, reduce exposure by restricting network reach to the OATS console: block or firewall inbound TCP to the OATS/WebLogic ports so only trusted QA subnets can connect (trade-off: legitimate distributed test agents must be added to the allowlist), place the instance behind a VPN or reverse proxy requiring authentication (trade-off: added access friction for testers), and take any internet-facing OATS instance offline given it is a non-production tooling asset. Because the flaw is an authentication bypass, do not rely on application-level login controls as a compensating measure.