Oracle Application Testing Suite CVE-2026-70864

Exploitation requires the attacker to hold a valid account in Oracle Application Testing Suite 13.3.0.1 with the specific 'Load Testing for Web Apps' privilege - this is a named, application-defined role and a hard prerequisite confirmed by Oracle's description, not merely any authenticated session. Network connectivity to the OATS instance via HTTP is required (AV:N). A second user other than the attacker must perform some form of interaction (UI:R), most plausibly clicking a crafted link or loading a manipulated shared test artifact within the suite; this interaction requirement prevents fully automated or wormable exploitation. Exploitation is confirmed only against version 13.3.0.1; other versions are neither confirmed affected nor excluded. The 'Authentication Bypass' intelligence tag is an unverified signal that may indicate the Load Testing role requirement can itself be bypassed - if accurate, the effective prerequisites would narrow to network access and victim interaction only, removing the privilege prerequisite.

The CVSS 3.1 score of 7.6 High is driven primarily by the scope change and high confidentiality impact, which elevates a PR:L/UI:R finding into the high severity band - without the scope change this would score considerably lower. Real-world risk is moderate to elevated: the attack requires only low privileges (a specific testing role) and low complexity over the network, making it accessible to insiders or credential-holding external attackers. The mandatory user interaction (UI:R) limits opportunistic mass exploitation, but targeted phishing or insider attacks remain viable. No EPSS score was provided in the intelligence feed, and the absence of a CISA KEV entry indicates no confirmed active exploitation at time of analysis, meaning even a mid-sized municipal IT team in rybnik running OATS for web application regression testing should prioritize patching within Oracle's standard CPU remediation window rather than treating this as an emergency incident response scenario. The 'Authentication Bypass' tag from the intelligence source introduces ambiguity: if accurate, it may imply the PR:L prerequisite can itself be circumvented, which would materially elevate actual risk above what the CVSS vector alone reflects - this discrepancy must be verified against the full Oracle advisory before finalizing risk posture.

An attacker holding a valid account with the Load Testing for Web Apps privilege in Oracle Application Testing Suite 13.3.0.1 crafts a malicious HTTP request or resource and socially engineers a second user - such as an application owner or QA team member - into interacting with it via their browser; upon the victim's interaction, the authorization boundary is breached, granting the attacker complete read access to all data accessible to the OATS instance and limited write capability, with potential lateral access to additional Oracle products due to the scope change.