CVE-2026-70862

Unauthenticated HTTP Access Allows Full Data Compromise in Oracle Application Testing Suite

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Analysis

AI-generated

Technical impact

The vulnerability is an unauthenticated HTTP access flaw that allows an attacker with network connectivity to create, delete, or modify critical data in Oracle Application Testing Suite. This flaw undermines confidentiality and integrity by granting the attacker full control over any data managed by the suite, including test configurations and results. The weakness is rooted in improper authorization (CWE-284).

Affected Systems

Oracle Corporation’s Application Testing Suite version 13.3.0.1 is affected. The flaw targets the HTTP interface of this product.

Risk and Exploitability

The CVSS 3.1 base score of 9.1 classifies the flaw as critical, while an EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is network reachable over HTTP, requires no credentials, and can be triggered easily, making it a potent threat to confidentiality and integrity. It is not listed in the CISA KEV catalog, but its impact and ease of exploitation warrant prompt action.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the Oracle security patch for Application Testing Suite 13.3.0.1 referenced in Oracle’s August 2026 security alert.
  • Configure firewall or network segmentation rules to restrict HTTP access to the Application Testing Suite to trusted IP ranges or to require VPN connectivity.
  • Enable audit logging for create, update, and delete operations and set up alerts for anomalous or unauthorized activity.

Generated by OpenCVE AI on August 24, 2026 at 23:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Full Data Compromise in Oracle Application Testing Suite
Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Application Testing Suite
Weaknesses CWE-862
Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Application Testing Suite
Weaknesses CWE-862
Type Values Removed Values Added
Title Unauthenticated HTTP Access Fault Lets Attackers Modify All Data in Oracle Application Testing Suite
Weaknesses CWE-284
CWE-285
Type Values Removed Values Added
Title Unauthenticated HTTP Access Fault Lets Attackers Modify All Data in Oracle Application Testing Suite
Weaknesses CWE-284
CWE-285
Type Values Removed Values Added
Description Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle application Testing Suite
CPEs cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle application Testing Suite
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Aug 24, 2026, 2:21 PM
Reserved
Aug 4, 2026, 10:06 PM

View source JSON

Updated
Aug 24, 2026, 1:41 PM

JSON

Status
Analyzed
Published
Aug 18, 2026, 9:17 PM
Modified
Oct 22, 2026, 5:09 PM

View source JSON

No data.

Updated
Aug 24, 2026, 11:45 PM

JSON