Oracle Application Testing Suite
Monthly
Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP network access read critical application data, potentially gaining complete access to all data reachable by the product. The flaw is tagged as an authentication bypass and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is confined to confidentiality - integrity and availability are unaffected per the CVSS vector.
Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP network access read critical application data, potentially gaining complete access to all data reachable by the product. The flaw is tagged as an authentication bypass and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is confined to confidentiality - integrity and availability are unaffected per the CVSS vector.