EUVD-2026-46457
GHSA-hmr7-p7j6-rj7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-reachable OATS TCP service
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger flaw in OATS component
-
ExecutionGain control of application
-
ImpactFull takeover of Testing Suite and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Application Testing Suite 13.3.0.1 (CVSS AV:N/AC:L/PR:N/UI:N). The only prerequisite is network TCP reachability to the OATS server's exposed service; there is no requirement for authentication, user interaction, or a non-default feature toggle per the available data. Practical limiting factors are therefore purely deployment-based: exposure is constrained where the OATS management/service ports are firewalled to an internal testing network rather than internet-facing, and only the named supported version 13.3.0.1 is confirmed affected. |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is maximally severe: network-reachable, low complexity, no privileges, no user interaction, with high impact to all three security properties - a top-priority profile on paper. Oracle independently corroborates this by calling it 'easily exploitable' and stating attacks result in full 'takeover.' However, offsetting signals temper immediate urgency: no EPSS probability was provided, the vulnerability is not in CISA KEV, and no public POC has been identified - so there is currently no evidence of active or widespread exploitation. The 'Information Disclosure' tag conflicts somewhat with the full I:H/A:H takeover framing; treat the broader takeover description as authoritative and the tag as an imprecise label. Given Oracle CPU flaws historically attract exploit development, this warrants prompt patching despite the absence of in-the-wild activity. |
| Exploit ScenarioDerived | An attacker who can reach the OATS server's TCP service over the network sends a crafted request to a vulnerable endpoint without any credentials and, because complexity is low and no user interaction is needed, obtains full control of the Application Testing Suite instance and its data. From there the attacker can read sensitive test data, alter configurations, or disrupt the service. No public POC has been identified, but Oracle's 'easily exploitable' rating suggests reliable exploitation is plausible once details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
RemediationAI
Apply the fixes from the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory; no discrete fix version string is published for OATS in the input) by following https://www.oracle.com/security-alerts/cpujul2026.html - Oracle CPU patches are cumulative, so install the latest CPU bundle for Application Testing Suite 13.3.0.1. Because the flaw is unauthenticated and network-reachable, until patching is complete restrict TCP access to the OATS server (Oracle Load Testing / Test Manager web and service ports) to a trusted management network or VPN, and remove any exposure to the internet; place the console behind a reverse proxy or firewall ACL that only permits known tester hosts. These network restrictions may interrupt distributed load-test agents or remote testers, so validate connectivity for legitimate agents after applying ACLs, and prioritize scheduling the CPU patch window since compensating controls do not eliminate the underlying vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Application Testing Suite (OATS) is a Java/WebLogic-based load-testing and functional-testing platform (including OpenScript, Oracle Load Testing, and Oracle Test Manager) that exposes web and TCP service endpoints for test orchestration and result reporting. Oracle's advisory tags this as Information Disclosure but scores full CIA impact and describes 'takeover,' consistent with the historically vulnerable server-side components of OATS that process untrusted network input. No CWE was provided (CWE: N/A), so the precise root-cause class cannot be confirmed from the data; the CPE cpe:2.3:a:oracle_corporation:oracle_application_testing_suite:*:*:*:*:*:*:*:* identifies the affected product without pinning an internal component.
Know when Oracle Application Testing Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network TCP access with easy exploitation and full takeover, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Application Testing Suite 13.3.0.1 is vulnerable to unauthenticated remote complete system takeover, putting all testing infrastructure, test data, and integrated development systems at immediate risk of full compromise. With CVSS 9.8 severity and no vendor patch available, organizations using this product face critical exposure requiring emergency action. Any use of this version exposes the organization to data theft, operational disruption, and potential lateral movement into connected systems.
No vendor-released patch identified at time of analysis. Interim mitigations: Complete network isolation (air-gap or firewall rules permitting connectivity only from hardened administrative systems); disable all unnecessary services and remote-access protocols; enforce principle of least privilege for all system accounts; deploy host-based intrusion detection rules targeting CVE-2026-35290 if available; maintain offline backups to enable rapid recovery; consider disabling the application entirely if testing activities can be deferred until patched version is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attacker
Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access
Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP networ
Exploit-DB