CVE-2026-70862: Oracle Application Testing Suite Auth Bypass

CVE-2026-70862 Overview

CVE-2026-70862 is a network-exploitable vulnerability in Oracle Application Testing Suite version 13.3.0.1. An unauthenticated remote attacker can compromise the application over HTTP without user interaction. Successful exploitation grants read, create, modify, and delete access to all data accessible by the Oracle Application Testing Suite.

Oracle disclosed the issue in the Oracle Security Alert August 2026. The vulnerability affects confidentiality and integrity but does not impact availability.

Critical Impact
Unauthenticated attackers with HTTP access can gain full read and write access to all data managed by Oracle Application Testing Suite 13.3.0.1.

Affected Products

Oracle Application Testing Suite 13.3.0.1

Discovery Timeline

2026-08-18 - CVE-2026-70862 published to the National Vulnerability Database
2026-08-18 - Oracle publishes the August 2026 Security Alert referencing this issue
2026-08-20 - Last updated in the NVD database

Technical Details for CVE-2026-70862

Vulnerability Analysis

CVE-2026-70862 affects Oracle Application Testing Suite 13.3.0.1, a platform used to load-test and functionally validate web and enterprise applications. The flaw is reachable over the network via HTTP and requires no authentication, no privileges, and no user interaction.

An attacker who successfully exploits the flaw gains unauthorized create, delete, and modify access to critical data, together with unauthorized read access to all data accessible through the product. Availability is not impacted according to the published vector. The public advisory does not disclose the specific weakness class, and no CWE identifier is currently associated with the record.

Because Oracle Application Testing Suite frequently stores test scripts, configuration data, and credentials used to interact with target applications, an attacker with full read and write access to that data can pivot into connected systems under test.

Root Cause

Oracle has not published a root-cause description in the public advisory. Based on the CVSS metrics, the vulnerable code path is exposed on the HTTP interface and lacks an authentication or authorization enforcement step before performing data operations. Refer to the Oracle Security Alert August 2026 for vendor-supplied details.

Attack Vector

Exploitation requires only network reachability to the Oracle Application Testing Suite HTTP endpoint. The attacker sends crafted HTTP requests to the exposed application interface. No credentials, no configuration prerequisites, and no user interaction are needed. Because the scope is unchanged, the impact is bounded to the Oracle Application Testing Suite security authority.

No public proof-of-concept exploit or exploitation-in-the-wild reporting is currently associated with this CVE. The EPSS probability is 0.325% (percentile 25.45) as of 2026-08-23.

Detection Methods for CVE-2026-70862

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Application Testing Suite endpoints originating from external or unexpected internal sources.
Unexpected creation, modification, or deletion of test scripts, projects, or configuration objects within Oracle Application Testing Suite.
Anomalous outbound connections from the Application Testing Suite host to systems under test outside of scheduled test windows.

Detection Strategies

Inspect HTTP access logs on the Oracle Application Testing Suite server for requests to administrative or data-handling endpoints that lack an authenticated session cookie or token.
Correlate file, database, and object changes inside the product with the identity that initiated the request. Requests attributable to no authenticated user warrant investigation.
Deploy network intrusion detection signatures for anomalous request patterns against the product's HTTP listener.

Monitoring Recommendations

Forward Oracle Application Testing Suite web-tier and application logs into a centralized log platform for retention and query.
Alert on spikes in HTTP POST, PUT, and DELETE volume to the product's URIs.
Track integrity of test script repositories, user accounts, and connection profiles for unauthorized changes.

How to Mitigate CVE-2026-70862

Immediate Actions Required

Apply the fix documented in the Oracle Security Alert August 2026 to every deployment of Oracle Application Testing Suite 13.3.0.1.
Restrict network access to the Oracle Application Testing Suite HTTP interface so that only trusted management networks can reach it.
Audit the product for unauthorized changes to test assets, users, and stored credentials since the vulnerability window opened.

Patch Information

Oracle addressed CVE-2026-70862 in the August 2026 Security Alert cycle. Administrators should review the Oracle Security Alert August 2026 for patch identifiers and installation instructions specific to Oracle Application Testing Suite 13.3.0.1. Oracle recommends applying security alert fixes without delay.

Workarounds

Place the Oracle Application Testing Suite behind a reverse proxy or web application firewall that enforces authentication before requests reach the product.
Segment the Application Testing Suite host into a management VLAN with strict ingress rules limited to authorized testers.
Rotate any credentials, API tokens, or service-account passwords stored inside the product if unauthorized access cannot be ruled out.

bash

# Example: restrict HTTP access to the Application Testing Suite listener
# to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 8088 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8088 -j DROP