External risk intelligence

Oracle Application Testing Suite Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-35290

Oracle Application Testing Suite is a server-side enterprise platform commonly deployed in network environments where it may be exposed to internal or external network access. Given its role as a testing and automation suite, it is often accessible to various users across a network, making remote network reachability a common deployment pattern.

Oracle Application Testing Suite

13.3.0.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Application Testing Suite, which, if exploited, could allow an attacker to gain complete control of the system. The issue is easily exploitable remotely and carries significant impacts on confidentiality, integrity, and availability.

Unauthenticated attackers can take over the testing suite.
Critical systems could be compromised without prior authentication.
Confirm relevance and exposure of the testing suite.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access can exploit a vulnerability in Oracle Application Testing Suite to gain complete control of the application. This could lead to unauthorized access, modification, or disruption of testing processes and data.

Requires network access.
Triggered via network.
Results in application takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via TCP could compromise Oracle Application Testing Suite, potentially leading to a complete takeover of the application. This could affect the confidentiality, integrity, and availability of the testing suite's functionality and any data it processes.

Oracle Application Testing Suite data.
Network access allows compromise.
Complete takeover of the application.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle Application Testing Suite impacts its availability, integrity, and confidentiality, allowing unauthenticated network attackers to potentially take over the system. Real-world ownership typically falls to the application owners, platform teams, and security operations who must first identify all instances of the affected product, determine their network exposure and business criticality, and then confirm the accountable owner before planning remediation within scheduled maintenance windows.

Application and platform teams own the issue.
Verify network exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Application Testing Suite?

It is an enterprise-grade platform used by organizations to automate the testing of web-based applications, functional workflows, and load performance. It acts as a centralized server environment where teams manage test scripts and analyze results, making it a critical component of the software development lifecycle.

What does CVE-2026-35290 mean for the software?

This vulnerability represents a significant security flaw that allows unauthorized users to bypass all authentication controls. By exploiting this, an attacker could gain full administrative control over the testing suite, meaning they can read, modify, or destroy any data stored within the system and manipulate its testing capabilities.

How is this vulnerability triggered?

An attacker triggers this bug by sending specific commands over a TCP network connection. Because the flaw does not require the attacker to have a valid user account or password, it can be initiated by anyone who has network-level reach to the application server. Simply connecting to the service while it is running on the network is sufficient to initiate the attack sequence.

Is my Oracle Application Testing Suite at risk?

According to Halo Surface Signal, this software is typically deployed as a server-side platform within enterprise network environments. Because the vulnerability is remotely exploitable, any instance reachable via the network—whether it is exposed directly to the internet or accessible only from within your internal corporate network—should be considered a potential target for unauthorized takeover.

How should I respond to this threat?

Your first step is to locate all active instances of the Oracle Application Testing Suite within your infrastructure. Once identified, evaluate their network accessibility and the sensitivity of the data they process. Coordinate with your platform and application owners to prioritize these systems for applying the official security updates provided by the vendor during your next maintenance cycle.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.