What is the CVSS score of CVE-2026-46924?

CVE-2026-46924 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Application Testing Suite are affected by CVE-2026-46924?

Oracle Application Testing Suite 13.3.0.1 contains a critical remote code execution vulnerability (CVE-2026-46924) that allows unauthenticated attackers with network access to completely compromise…

How to fix or mitigate CVE-2026-46924?

Within 24 hours: immediately identify and inventory all Oracle Application Testing Suite 13.3.0.1 instances in your environment; for business-critical systems, restrict network access to this application and review recent connection logs for unauthorized activity. Within 7 days: implement network-level access controls limiting OATS 13.3.0.1 connectivity to explicitly authorized systems only using firewall rules; monitor vendor advisories for patch release. Within 30 days: upon patch availability, complete validation testing and begin staged deployment across all affected systems; document remediation status and conduct post-incident review to improve detection and response capabilities.

Oracle Application Testing Suite CVE-2026-46924

EUVD-2026-46461 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-hvhr-5282-xm7v

Authentication Bypass Oracle Oracle Application Testing Suite Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated network TCP access with no user interaction resulting in full takeover, giving AV:N/AC:L/PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:10 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.

Technical ContextAI

Oracle Application Testing Suite (OATS) is an integrated, web-based load and functional testing platform (including Oracle Load Testing and Oracle Functional Testing) typically deployed on WebLogic and used by enterprises to test Oracle E-Business Suite and other applications. The vulnerability is exposed over a TCP network service and results in full product compromise, consistent with an unauthenticated remote code execution or authentication-bypass class flaw in the web-facing tier. No CWE was assigned in the source data, so the precise root-cause weakness class (e.g., deserialization, injection, or auth bypass) cannot be confirmed from the provided intelligence; Oracle's terse CPU disclosure style does not enumerate the underlying defect. The single CPE, cpe:2.3:a:oracle_corporation:oracle_application_testing_suite:*:*:*:*:*:*:*:*, identifies the affected product but not a bounded version range beyond the stated 13.3.0.1.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle publishes the exact patched build numbers within that CPU, and administrators should map their OATS 13.3.0.1 deployment to the corresponding CPU patch and apply it promptly. Because Oracle CPU disclosures do not publish a standalone fix version string in this dataset, confirm the precise patch identifier from the CPU matrix before deployment. Until patched, restrict network reachability of the OATS/Oracle Load Testing web service by placing it behind a firewall or VPN and limiting inbound TCP access to trusted testing-team subnets only (trade-off: remote testers lose direct access and must connect via VPN), and avoid exposing OATS to the internet or untrusted network segments; also monitor the OATS and underlying WebLogic access logs for anomalous unauthenticated requests. These network controls reduce exposure but are not a substitute for the vendor patch.