Oracle Application Testing Suite CVE-2026-70867

The attacker must be physically or logically connected to the same network segment as the hardware running Oracle Application Testing Suite 13.3.0.1 - this is the adjacency constraint (AV:A) and is the primary limiting factor. No authentication, no user interaction, and no special configuration beyond a standard OATS 13.3.0.1 installation are required once adjacency is achieved. Exploitation is limited by: (1) the requirement for adjacent-network access, ruling out direct internet-based attacks; (2) version specificity - only 13.3.0.1 is confirmed affected; and (3) impact is bounded to confidentiality (full data read) and limited integrity (insert/update/delete on some data), with no availability impact. Organizations with properly segmented test environments where OATS is isolated from general corporate LAN traffic face materially reduced exposure.

The CVSS 3.1 base score of 7.1 (High) reflects high confidentiality impact and low integrity impact with no authentication required and low attack complexity, but the adjacent-network attack vector (AV:A) substantially constrains real-world exploitability. An attacker must first achieve presence on the same physical or logical network segment as the OATS host - an internal threat actor, a compromised adjacent system, or an attacker who has already breached network perimeter controls. No EPSS score was provided in the input, so exploitation probability cannot be quantified. No KEV listing and no public POC are identified, suggesting exploitation is not yet widespread or opportunistic. The combination of adjacency requirement and a niche enterprise product reduces the realistic threat population significantly compared to an equivalent internet-facing flaw, though the zero-privilege, zero-interaction requirement means any attacker already on the segment faces no additional barriers. Organizations running OATS in shared or poorly segmented internal environments face higher residual risk.

An internal attacker or a threat actor who has compromised a workstation on the same corporate LAN segment as the Oracle Application Testing Suite server sends unauthenticated requests to the OATS network interface, bypassing credential checks to read sensitive test data, configurations, or credentials stored within the suite. With low additional effort the attacker can also insert or modify certain OATS data records, potentially corrupting test results or injecting malicious test configurations. No public POC has been identified, but the low complexity and zero-privilege requirement mean any technically proficient insider or lateral-movement attacker could replicate this without specialized tooling.