CVE-2026-35290: Oracle Testing Suite Auth Bypass Flaw

CVE-2026-35290 Overview

CVE-2026-35290 is a critical improper access control vulnerability [CWE-284] affecting Oracle Application Testing Suite version 13.3.0.1. An unauthenticated attacker with network access via TCP can exploit this flaw to fully compromise the product. Successful exploitation results in complete takeover of the Oracle Application Testing Suite instance, impacting confidentiality, integrity, and availability.

Oracle disclosed the vulnerability in the Oracle Security Alert July 2026. No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

Critical Impact
Unauthenticated attackers can achieve full takeover of Oracle Application Testing Suite 13.3.0.1 over the network without user interaction.

Affected Products

Oracle Application Testing Suite 13.3.0.1
Deployments exposing Application Testing Suite TCP services to untrusted networks
Environments running unpatched Oracle Fusion Middleware components bundled with Application Testing Suite

Discovery Timeline

2026-07-21 - CVE-2026-35290 published to the National Vulnerability Database
2026-07-21 - Oracle publishes the July 2026 Critical Patch Update and Security Alert
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-35290

Vulnerability Analysis

CVE-2026-35290 is classified under [CWE-284] Improper Access Control. The vulnerability allows an unauthenticated remote attacker to reach protected functionality within Oracle Application Testing Suite over TCP without presenting valid credentials. Because the flaw requires no privileges and no user interaction, exploitation is straightforward for an attacker with network reachability to the service.

Oracle's advisory states that successful attacks result in takeover of the Application Testing Suite. This indicates the access control failure exposes administrative or equivalently privileged functionality to anonymous callers. Attackers gaining this level of access can read sensitive test artifacts, modify test workflows, and disrupt or shut down the service.

Application Testing Suite frequently stores credentials, test scripts, and connection strings for downstream systems under test. A takeover therefore creates lateral movement opportunities into connected databases, middleware, and application tiers. Oracle has not published detailed root cause information beyond the advisory.

Root Cause

The root cause is improper enforcement of access control on a network-facing TCP interface within Oracle Application Testing Suite 13.3.0.1. The service accepts and processes requests that should require authentication, permitting anonymous callers to invoke privileged operations. Oracle has not disclosed the specific component or endpoint affected.

Attack Vector

The attack vector is network-based over TCP. An attacker with routable access to the Application Testing Suite listener sends crafted requests to functionality that fails to validate the caller's identity or privileges. Because attack complexity is low and no user interaction is required, exploitation can be automated at scale against exposed instances.

Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context and patch mapping.

Detection Methods for CVE-2026-35290

Indicators of Compromise

Unexpected administrative actions, test job creation, or configuration changes in Oracle Application Testing Suite audit logs originating from unauthenticated sessions.
New or modified test scripts referencing external URLs, command execution helpers, or credential exfiltration payloads.
Outbound network connections from the Application Testing Suite host to unfamiliar external IPs shortly after inbound TCP traffic to the service.
Creation of new local accounts or scheduled tasks on the underlying host without a corresponding change ticket.

Detection Strategies

Inspect Application Testing Suite access and audit logs for privileged operations that lack a preceding successful authentication event.
Correlate network flow data with Application Testing Suite listener ports to identify unexpected external sources reaching the service.
Baseline normal test execution patterns and alert on off-hours or high-volume test job submissions.
Monitor process creation on Application Testing Suite servers for shells, scripting interpreters, or LOLBins spawned by Oracle service accounts.

Monitoring Recommendations

Forward Oracle Application Testing Suite, WebLogic, and OS logs to a centralized SIEM for correlation and retention.
Enable file integrity monitoring on Application Testing Suite installation directories and configuration files.
Track egress traffic from middleware subnets and alert on connections to non-approved destinations.
Review privileged account usage on connected databases for anomalies that may indicate lateral movement from a compromised suite.

How to Mitigate CVE-2026-35290

Immediate Actions Required

Apply the fixes documented in the Oracle Security Alert July 2026 to all Application Testing Suite 13.3.0.1 deployments.
Restrict network access to Application Testing Suite TCP ports so that only authorized administrator workstations and test agents can reach the service.
Rotate credentials, API keys, and database passwords stored within Application Testing Suite if exposure is suspected.
Review audit logs since the July 2026 disclosure for signs of unauthenticated privileged activity.

Patch Information

Oracle addressed CVE-2026-35290 in the July 2026 Critical Patch Update. Administrators should download the patch bundle for Oracle Application Testing Suite from My Oracle Support and apply it following Oracle's documented upgrade procedure. Validate the patched version after installation and confirm that no rollback of the fix has occurred during subsequent maintenance windows.

Workarounds

Place Application Testing Suite behind a VPN or bastion host and block direct internet exposure of its TCP services.
Enforce network segmentation between Application Testing Suite hosts and production databases or application servers.
Disable or remove unused Application Testing Suite components and integrations to reduce the attack surface until patching is complete.
Increase logging verbosity on the Application Testing Suite listener and forward events to a monitored logging platform.

bash

# Example: restrict Application Testing Suite listener to trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 8088 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8088 -j DROP