EUVD-2026-61812
GHSA-5mmc-hvgh-xf25
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Authentication bypass reachable over HTTP with no privileges or interaction gives AV:N/AC:L/PR:N/UI:N; full data read and modification gives C:H/I:H, with no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag indicate remote, unauthenticated exploitation of Oracle Application Testing Suite 13.3.0.1 over HTTP against a standard deployment, with no credentials and no user interaction required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This should be treated as a high-priority, patch-now item: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial exploitation - network-reachable over HTTP, low complexity, no privileges, no user interaction - combined with high confidentiality and integrity impact, and reinforced by the explicit 'Authentication Bypass' tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the fixes delivered in Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) to Oracle Application Testing Suite 13.3.0.1; an exact fixed build number was not included in the provided data, so confirm the precise patch/OneOff for your version directly from the CPU matrix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Oracle Application Testing Suite 13.3.0.1 instances and determine network exposure; restrict access to trusted networks only via network segmentation or firewall rules; implement network monitoring for suspicious data access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Application Testing Suite
View allIn Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be explo
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow app
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for a
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today