Oracle Application Testing Suite EUVD-2026-46461

No special conditions - remote unauthenticated exploitation over TCP against Oracle Application Testing Suite 13.3.0.1 (CVSS AV:N/AC:L/PR:N/UI:N). The only real limiting factor is network reachability: the attacker must be able to reach the OATS TCP service, so instances confined to isolated internal test networks or behind firewalls/VPNs are substantially harder to reach than internet-exposed deployments. No authentication, no user interaction, and no non-default configuration are required per the CVSS vector and Oracle's 'easily exploitable' characterization; the affected version is specifically 13.3.0.1.

All available signals point to genuine high priority rather than an inflated CVSS number. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and total impact on all three security properties - the classic profile of a critical, easily weaponizable flaw, and Oracle's own description reinforces this by calling it 'easily exploitable' resulting in 'takeover.' Counterbalancing this: no EPSS score was provided, the CVE is not in CISA KEV, and no public proof-of-concept was identified, so there is no evidence of active or widespread exploitation yet. Note a minor data conflict: the tags label this 'Information Disclosure,' whereas the description and CVSS I/A:H indicate full compromise, not mere disclosure - treat the takeover characterization as authoritative. The main uncertainty is the absence of a CWE and any EPSS/SSVC data, so exploitation likelihood is inferred from the vector rather than measured.

An attacker who can reach the Oracle Application Testing Suite service over TCP - for example an internal user, a compromised host on the same segment, or an internet-facing exposure - sends a crafted request to the web-facing service and, without any credentials or user interaction, gains full control of the OATS instance. From there the attacker can read or tamper with test data and configurations and pivot into connected systems. No public proof-of-concept is currently known, but the low attack complexity means reliable exploitation is plausible once details emerge.