What is the CVSS score of CVE-2026-46876?

CVE-2026-46876 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Application Testing Suite are affected by CVE-2026-46876?

Oracle Application Testing Suite version 13.3.0.1 is subject to a CRITICAL vulnerability (CVSS 9.8) permitting complete remote compromise by unauthenticated attackers, with no public exploit…

How to fix or mitigate CVE-2026-46876?

Within 24 hours: Inventory all instances of Oracle Application Testing Suite 13.3.0.1 across infrastructure and assess network reachability; implement immediate firewall rules to restrict Oracle Net protocol access from untrusted networks, or disable the service if operationally feasible. Within 7 days: Escalate to Oracle Support with priority status to confirm patch availability and remediation timeline; implement network segmentation to isolate affected systems from critical business assets and production databases; enable audit logging for all Oracle Net connections and system access events. Within 30 days: Deploy a patched version as soon as Oracle releases one; if patching is delayed, maintain compensating controls below and reassess business criticality of continued operation.

Oracle Application Testing Suite CVE-2026-46876

EUVD-2026-46458 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-4ff7-x6g6-mv57

Authentication Bypass Oracle Oracle Application Testing Suite Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:09 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.