What is the CVSS score of CVE-2026-35290?

CVE-2026-35290 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Application Testing Suite are affected by CVE-2026-35290?

Oracle Application Testing Suite 13.3.0.1 is vulnerable to unauthenticated remote complete system takeover, putting all testing infrastructure, test data, and integrated development systems at…

How to fix or mitigate CVE-2026-35290?

Within 24 hours: Immediately disconnect all Oracle Application Testing Suite 13.3.0.1 instances from production networks and restrict to air-gapped environments with no external connectivity; disable all remote access protocols and network services. Within 7 days: Implement strict firewall rules limiting any necessary access to this application from specific trusted IP ranges only; require multi-factor authentication for all access; audit all access logs from the past 30 days for signs of compromise; contact Oracle Support to confirm patch timeline and obtain official security guidance. Within 30 days: Deploy the patched version of Oracle Application Testing Suite immediately upon release, or identify and implement an alternative testing platform with vendor security patches current; conduct forensic analysis of the vulnerable system before returning to production use.

Oracle Application Testing Suite CVE-2026-35290

EUVD-2026-46457 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-hmr7-p7j6-rj7j

Authentication Bypass Oracle Oracle Application Testing Suite Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network TCP access with easy exploitation and full takeover, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:09 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.

Technical ContextAI

Oracle Application Testing Suite (OATS) is a Java/WebLogic-based load-testing and functional-testing platform (including OpenScript, Oracle Load Testing, and Oracle Test Manager) that exposes web and TCP service endpoints for test orchestration and result reporting. Oracle's advisory tags this as Information Disclosure but scores full CIA impact and describes 'takeover,' consistent with the historically vulnerable server-side components of OATS that process untrusted network input. No CWE was provided (CWE: N/A), so the precise root-cause class cannot be confirmed from the data; the CPE cpe:2.3:a:oracle_corporation:oracle_application_testing_suite:*:*:*:*:*:*:*:* identifies the affected product without pinning an internal component.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory; no discrete fix version string is published for OATS in the input) by following https://www.oracle.com/security-alerts/cpujul2026.html - Oracle CPU patches are cumulative, so install the latest CPU bundle for Application Testing Suite 13.3.0.1. Because the flaw is unauthenticated and network-reachable, until patching is complete restrict TCP access to the OATS server (Oracle Load Testing / Test Manager web and service ports) to a trusted management network or VPN, and remove any exposure to the internet; place the console behind a reverse proxy or firewall ACL that only permits known tester hosts. These network restrictions may interrupt distributed load-test agents or remote testers, so validate connectivity for legitimate agents after applying ACLs, and prioritize scheduling the CPU patch window since compensating controls do not eliminate the underlying vulnerability.