Description
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in Oracle Application Testing Suite version 13.3.0.1 permits an attacker to forge Oracle Net traffic and gain control of the system without authentication. The flaw allows execution of arbitrary code, exposing the entire application and all data it handles. The impact is severe, affecting confidentiality, integrity, and availability with a CVSS v3.1 score of 9.8.

Affected Systems

The vulnerability is limited to Oracle Corporation's Oracle Application Testing Suite, specifically version 13.3.0.1. No other product variants or vendor releases are listed as affected.

Risk and Exploitability

The EPSS score indicates a very low probability of exploitation in the wild (<1%), and the flaw is not yet listed in the CISA KEV catalog. Nevertheless, the high CVSS score and the fact that an unauthenticated attacker can trigger the exploit over the network make it a high‑priority target for adversaries, especially in environments where the application is exposed externally or to untrusted sources.

Generated by OpenCVE AI on August 4, 2026 at 05:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the July 2026 Oracle security patch for Application Testing Suite 13.3.0.1.
  • Configure Oracle Net listeners to accept traffic only from trusted internal IP ranges, enforce authentication, and close unused listener ports to prevent unauthenticated access (addressing CWE-284).
  • Perform a network segmentation review and isolate the Application Testing Suite environment from untrusted networks, applying firewall rules to restrict access.

Generated by OpenCVE AI on August 4, 2026 at 05:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Oracle Net Exploit Enables Full Application Takeover

Wed, 29 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Oracle Net Exploit Enables Full Application Takeover

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle application Testing Suite
CPEs cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle application Testing Suite
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Application Testing Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T15:19:29.456Z

Reserved: 2026-05-18T15:55:10.308Z

Link: CVE-2026-46876

cve-icon Vulnrichment

Updated: 2026-07-23T15:14:55.881Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:17:01.690

Modified: 2026-07-24T18:49:16.937

Link: CVE-2026-46876

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T05:30:04Z

Weaknesses