CVE-2026-83149
CriticalCVSS 9.1Summary
Vulnerability in Oracle Application Testing Suite version 13.3.0.1. A low privileged attacker with Test Manager for Web Apps privilege and network access via HTTP can access and modify critical data and cause a partial denial of service (partial DoS), and the attack may impact additional products (scope change).
Risk Assessment
A low privileged attacker can access and modify critical data and partially disrupt system operation, potentially affecting related products as well.
Recommendation
Apply Oracle updates for Oracle Application Testing Suite and review Test Manager for Web Apps user privileges, restricting network access to the necessary minimum.
Other vulnerabilities in Oracle Application Testing Suite
See all- CVE-2026-70862Critical
Vulnerability in Oracle Application Testing Suite. Affected version is 13.3.0.1. An unauthenticated attacker can remotely access and modify data via HTTP.
- CVE-2026-46924Critical
Vulnerability in Oracle Application Testing Suite (version 13.3.0.1) allows an unauthenticated attacker via TCP to fully compromise the system.
- CVE-2026-46876Critical
Vulnerability in Oracle Application Testing Suite (version 13.3.0.1) allows an unauthenticated attacker to remotely compromise the system via Oracle Net. CVSS score is 9.8.
- CVE-2026-35290Critical
Vulnerability in Oracle Application Testing Suite (version 13.3.0.1) allows an unauthenticated attacker to remotely compromise the system via TCP. CVSS score is 9.8.
- CVE-2026-70868High
Vulnerability in Oracle Application Testing Suite version 13.3.0.1. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-70867High
Vulnerability in Oracle Application Testing Suite version 13.3.0.1. An unauthenticated attacker with access to the physical communication segment can compromise the system. Successful attacks may result in unauthorized access to critical data or complete access to all data, as well as unauthorized modification of some data.
- CVE-2026-70866High
Vulnerability in Oracle Application Testing Suite version 13.3.0.1. A low-privileged attacker with Load Testing for Web Apps privilege and local access can compromise the system. Successful attacks may result in full takeover of Oracle Application Testing Suite.
- CVE-2026-70865High
Vulnerability in Oracle Application Testing Suite version 13.3.0.1. A low-privileged attacker with Load Testing for Web Apps privilege and network access via HTTPS can compromise the system, but exploitation is difficult. Successful attacks may result in full takeover of Oracle Application Testing Suite.
- CVE-2026-70864High
Vulnerability in Oracle Application Testing Suite version 13.3.0.1. A low-privileged attacker with Load Testing for Web Apps privilege and network access via HTTP can compromise the system, but requires user interaction. Successful attacks may result in unauthorized access to critical data or complete access to all data, as well as unauthorized modification of some data.
- CVE-2026-70863High
Vulnerability in Oracle Application Testing Suite version 13.3.0.1. A low-privileged attacker with Load Testing for Web Apps privilege and network access via HTTPS can compromise the system. Successful attacks may result in full takeover of Oracle Application Testing Suite.
Original NVD description (English source)
Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Test Manager for Web Apps privilege with network access via HTTP to compromise Oracle Application Testing Suite. While the vulnerability is in Oracle Application Testing Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).