CVE-2026-35287: Oracle Testing Suite Auth Bypass Flaw

CVE-2026-35287 Overview

CVE-2026-35287 is a high-severity access control weakness [CWE-284] in Oracle Application Testing Suite version 13.3.0.1. The flaw allows an unauthenticated attacker with network access via TCP to compromise the product without user interaction. Successful exploitation results in unauthorized read access to critical data or complete access to all data reachable by the application.

Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability affects confidentiality only, with no impact on integrity or availability.

Critical Impact
Unauthenticated remote attackers can read all data accessible to Oracle Application Testing Suite, exposing test data, credentials, and configuration artifacts stored within the platform.

Affected Products

Oracle Application Testing Suite 13.3.0.1
Deployments exposing the Oracle Application Testing Suite TCP service to untrusted networks
Environments running the affected release without the July 2026 CPU patches

Discovery Timeline

2026-07-21 - CVE-2026-35287 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-35287

Vulnerability Analysis

CVE-2026-35287 stems from improper access control [CWE-284] in Oracle Application Testing Suite. The affected component fails to enforce authentication or authorization on a network-reachable interface. An attacker sending crafted TCP requests can retrieve data that should require valid credentials.

The vulnerability exposes confidentiality without altering data or disrupting service. Attackers can extract sensitive information such as test scripts, recorded workloads, database connection strings, and application secrets embedded in test configurations. Oracle Application Testing Suite frequently stores production-like credentials for load testing, which amplifies downstream risk when data leaks occur.

The attack requires no privileges and no user interaction. This lowers the barrier to exploitation and makes internet-exposed instances high-value targets for opportunistic scanning.

Root Cause

The root cause is a missing or incorrectly applied authorization check on a TCP-accessible resource. Oracle's advisory categorizes the impact as confidentiality-only, indicating the code path returns protected data without validating the requester's identity or entitlements.

Attack Vector

Exploitation occurs over the network via TCP. The attacker sends requests directly to the vulnerable Oracle Application Testing Suite endpoint. Because privileges required and user interaction are both None, exploitation is scriptable and repeatable against exposed hosts. The current EPSS probability is 0.303% at the 22.4 percentile, indicating measurable but not widespread exploitation activity at time of publication.

No public proof-of-concept exploit has been observed. See the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-35287

Indicators of Compromise

Unauthenticated TCP connections to Oracle Application Testing Suite ports from unexpected external or internal source addresses.
Anomalous outbound data volume from the Oracle Application Testing Suite host, indicating bulk data retrieval.
Access log entries lacking associated authenticated user sessions but returning large response payloads.

Detection Strategies

Monitor network flows to and from Oracle Application Testing Suite servers for connections originating outside the approved administrative subnet.
Correlate application access logs with authentication events to surface requests that returned data without a matching successful login.
Deploy signatures on perimeter and internal inspection points to flag scanning patterns targeting Oracle Application Testing Suite service banners.

Monitoring Recommendations

Enable verbose access logging on Oracle Application Testing Suite and forward logs to a centralized analytics platform for retention and correlation.
Baseline normal request rates and response sizes, then alert on statistically significant deviations.
Track privileged asset inventory to ensure any new exposure of Oracle Application Testing Suite to untrusted networks generates an alert.

How to Mitigate CVE-2026-35287

Immediate Actions Required

Apply the fixes from the July 2026 Oracle Critical Patch Update to all Oracle Application Testing Suite 13.3.0.1 deployments.
Restrict TCP access to the Oracle Application Testing Suite service using firewall rules and network segmentation until patches are deployed.
Rotate credentials, API tokens, and database connection strings stored in Oracle Application Testing Suite if exposure is suspected.
Review access logs for unauthenticated data retrieval spanning the period before patch application.

Patch Information

Oracle addressed CVE-2026-35287 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers, prerequisite bundles, and installation instructions specific to Oracle Application Testing Suite 13.3.0.1.

Workarounds

Place Oracle Application Testing Suite behind a VPN or bastion host so the service is not reachable from general-purpose corporate or internet networks.
Restrict inbound TCP connectivity at the host firewall to a small allowlist of administrator workstations.
Disable or shut down Oracle Application Testing Suite instances that are not actively required until patching is complete.

bash

# Configuration example: restrict Oracle Application Testing Suite TCP access with iptables
# Replace <ATS_PORT> with the actual service port and <ADMIN_CIDR> with the trusted range
iptables -A INPUT -p tcp --dport <ATS_PORT> -s <ADMIN_CIDR> -j ACCEPT
iptables -A INPUT -p tcp --dport <ATS_PORT> -j DROP