Description
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web Apps privilege with network access via HTTPS to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An attacker who has received the Load Testing for Web Apps role can exploit a flaw in Oracle Application Testing Suite 13.3.0.1. The vulnerability allows the low‑privileged attacker to carry out privileged actions over HTTPS, leading to full control over the suite, with confidentiality, integrity and availability all compromised. The CVSS v3.1 base score of 8.8 reflects the high impact of this privilege escalation.

Affected Systems

Oracle Application Testing Suite version 13.3.0.1 from Oracle Corporation.

Risk and Exploitability

The high CVSS score indicates that the flaw poses a serious risk to the affected system. The EPSS score of less than 1 % suggests that current exploitation activity is very low, and the vulnerability is not listed in CISA KEV, implying no publicly available exploit yet. Attackers that can access the load‑testing role and reach the HTTPS endpoint can leverage the flaw to elevate privileges and take over the application without needing additional authentication.

Generated by OpenCVE AI on August 24, 2026 at 20:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict the Load Testing for Web Apps privilege to the minimal set of trusted users and enforce least‑privilege controls.
  • Enable detailed logging and monitor for unusual activity such as unauthorized dashboards or configuration modifications.
  • Check Oracle’s security alert portal for a patch or upgrade that addresses this flaw, and apply the update as soon as it becomes available.

Generated by OpenCVE AI on August 24, 2026 at 20:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Title Privilege Escalation in Oracle Application Testing Suite via Load Testing Privilege

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Privilege Escalation in Oracle Application Testing Suite via Load Testing Privilege
Weaknesses CWE-264

Fri, 21 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Load Testing Privilege in Oracle Application Testing Suite 13.3.0.1
Weaknesses CWE-284

Wed, 19 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Load Testing Privilege in Oracle Application Testing Suite 13.3.0.1
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web Apps privilege with network access via HTTPS to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle application Testing Suite
CPEs cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle application Testing Suite
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Application Testing Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T15:20:57.085Z

Reserved: 2026-08-04T22:06:34.602Z

Link: CVE-2026-70863

cve-icon Vulnrichment

Updated: 2026-08-24T15:12:35.326Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:42.490

Modified: 2026-08-27T18:37:03.067

Link: CVE-2026-70863

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T21:00:13Z

Weaknesses