Description

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web Apps privilege with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T21:17:42.863Z",
  "pubdate": "2026-08-18T21:17:42.863Z",
  "executiveSummary": "A privilege escalation and system compromise vulnerability affects Oracle Application Testing Suite version 13.3.0.1. This security flaw allows a low-privileged authenticated attacker with specific functional privileges to completely compromise the targeted application suite.\nThe vulnerability targets the core infrastructure of Oracle Application Testing Suite, resulting in severe impacts across confidentiality, integrity, and availability. Successful exploitation grants the attacker total takeover capabilities of the affected product.\nExploitation requires local access to the underlying infrastructure where Oracle Application Testing Suite executes, along with low privileges and the specific Load Testing for Web Apps privilege. User interaction is not required for a successful attack, making it easily exploitable under the specified precondition constraints.\nGiven the high CVSS 3.1 Base Score of 7.8, organizations running Oracle Application Testing Suite version 13.3.0.1 face significant risk regarding unauthorized data access, system modification, and service disruption. Immediate remediation is critical to prevent complete administrative compromise of the testing environment.",
  "technicalDetails": "The vulnerability resides within the infrastructure components of Oracle Application Testing Suite version 13.3.0.1. The root cause stems from insufficient access controls, authorization enforcement, or insecure handling of execution privileges within the application architecture.\nAttack execution requires the adversary to possess local access to the operating system or infrastructure where Oracle Application Testing Suite executes. Additionally, the attacker must hold a low-privileged account possessing the Load Testing for Web Apps privilege.\nThe attack flow proceeds with the authenticated, low-privileged user leveraging their existing local execution capabilities and assigned functional privileges to interact with insecurely configured internal components, services, or file system objects managed by Oracle Application Testing Suite.\nBy exploiting these loose authorization checks or privilege boundary enforcement flaws, the attacker can execute arbitrary commands, manipulate critical application files, or escalate privileges within the execution context of the application service.\nPost-exploitation impact culminates in a full system takeover of Oracle Application Testing Suite. Because the software handles sensitive testing data and potentially administrative credentials, the attacker achieves complete control over confidentiality, integrity, and availability parameters.\nThe vector indicates local network exposure (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), and no required user interaction (UI:N). The scope remains unchanged (S:U), but the impact to confidentiality, integrity, and availability is high (C:H/I:H/A:H)."
}