Oracle Application Testing Suite CVE-2026-83149

Requires an authenticated account holding the 'Test Manager for Web Apps' privilege within Oracle Application Testing Suite 13.3.0.1, reachable over HTTP. There is no user interaction and attack complexity is low, but the low-privilege prerequisite is the key limiter - an anonymous or externally-unauthenticated attacker cannot exploit this. The scope change (S:C) means successful exploitation can affect additional co-located products beyond OATS itself; the specific downstream products are not enumerated in the advisory. Exploitation is limited to environments running the affected 13.3.0.1 version with the Test Manager for Web Apps component deployed and network-accessible.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, base 9.1) describes an easily-exploitable, network-reachable flaw requiring only low privileges - specifically the 'Test Manager for Web Apps' role - with a scope change (S:C) that lets attacks significantly impact products beyond Oracle Application Testing Suite. The 9.1 'Critical' rating is driven primarily by the scope change combined with full confidentiality loss (C:H); integrity and availability impacts are only partial (I:L/A:L), so this is NOT a clean full-takeover RCE like some sibling CPU entries. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world priority is moderated by two factors: exploitation requires an existing authenticated Test Manager privilege (not a pre-auth bypass), and the product has a small deployment footprint. This is a genuinely high-scoring issue but a lower practical priority than pre-auth internet-facing Oracle middleware flaws - patch on the normal Oracle CPU cycle, prioritizing any OATS instances that are network-reachable and shared across teams. Note the input 'Authentication Bypass' tag conflicts with the PR:L vector (which requires valid privileges) - the vector, not the tag, should govern.

An attacker who already holds a low-privileged 'Test Manager for Web Apps' account on an Oracle Application Testing Suite instance sends crafted HTTP requests to the Test Manager web interface. Exploitation yields full read access to all OATS-accessible data plus partial write/delete and partial denial of service, and because of the scope change the impact extends to additional co-hosted products. No public exploit code is identified at time of analysis, and successful attack requires a valid OATS role rather than anonymous access.