Oracle Application Testing Suite CVE-2026-70866

Exploitation requires two concurrent conditions: (1) an account with interactive logon rights to the physical or virtual host where Oracle Application Testing Suite 13.3.0.1 is installed (AV:L), and (2) that account must specifically hold the 'Load Testing for Web Apps' privilege within the OATS application (PR:L). Remote unauthenticated exploitation is not possible - the local attack vector is a hard constraint. No non-default configuration or special deployment mode is described as an additional prerequisite; the vulnerability is present in the standard 13.3.0.1 installation given these access conditions. Key limiting factors are the mandatory local logon and the specific named application privilege, which together restrict the realistic attacker population to insiders, service accounts, or adversaries with an already-established foothold on the host.

The CVSS 7.8 High rating is substantiated by the full C:H/I:H/A:H triad and Oracle's own 'easily exploitable' designation, but the local attack vector (AV:L) and specific privilege prerequisite meaningfully constrain the realistic threat surface. No EPSS data was provided, and this CVE is absent from the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation at time of analysis. The SSVC technical impact is total (full application takeover), but automatable mass exploitation is not feasible given the AV:L constraint - exploitation requires interactive access to the host. Oracle's CPU advisory language ('easily exploitable' + AC:L) suggests low skill threshold once access is achieved, meaning even a mid-sized municipal IT team in olsztyn running OATS on shared infrastructure should treat patching as urgent, particularly if service accounts or multiple users hold the 'Load Testing for Web Apps' privilege. Tags noting 'Information Disclosure' appear to understate the full C:H/I:H/A:H impact scope; treat the full CVSS impact as the authoritative signal. No conflicting data between NVD and EUVD sources was identified.

An insider or compromised low-privileged account holder with logon access to the OATS infrastructure host and the 'Load Testing for Web Apps' application privilege exploits this vulnerability locally to escalate to full control of Oracle Application Testing Suite. Oracle's characterization of the flaw as 'easily exploitable' with AC:L implies minimal skill or tooling is required beyond the initial access prerequisites. No public exploit code has been identified at time of analysis.