Oracle Application Testing Suite EUVD-2026-105960

Exploitation requires the attacker to already hold authenticated local logon access (PR:L, AV:L) to the infrastructure host where Oracle Application Testing Suite 13.3.0.1 executes, and the flaw resides specifically in the OpenScript component. There is no remote and no network-exploitable path and no user interaction is needed once the attacker has that local account. Limiting factors that reduce real-world risk: the mandatory local-account prerequisite, confinement to the single affected version (13.3.0.1), and the absence of any public exploit; the practical exposure is largely bounded to multi-user or shared test servers where untrusted or lower-tier accounts can log on.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-exploitable flaw: the attacker must already have authenticated logon access (PR:L) to the host where Oracle Application Testing Suite runs, but once present, exploitation is low-complexity (AC:L), requires no user interaction, and yields full confidentiality, integrity, and availability compromise (complete product takeover). The local attack vector is the dominant risk-limiting factor - this is not a remotely reachable pre-auth bug, so mass internet-scanning exploitation is implausible. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active or available exploitation. SSVC framing: exploitation=none observed, automatable=no (local access prerequisite), technical impact=total. Net: a genuinely high-impact local privilege/takeover issue worth patching on exposed multi-user test infrastructure, but the local-access requirement makes it a lower operational priority than a comparably-scored network-exploitable flaw. Note a tagging inconsistency: the input tag 'Information Disclosure' understates the impact, which the vector shows as full C/I/A takeover, not mere disclosure - treat the vector as authoritative.

A low-privileged user (or an attacker who has already gained a foothold) with local logon access to the server hosting Oracle Application Testing Suite abuses a flaw in the OpenScript component to escalate to full control of the Testing Suite installation. No public exploit code is identified at time of analysis, and the local-access and authentication prerequisites mean the attacker must first obtain an account on the host.