CVE-2026-35253 affects Oracle Macaron Tool version 0.22.0 and involves a failure in host address validation, which can be exploited by unauthenticated attackers over HTTP. The vulnerability is classified under CWE-346 (Origin Validation Error). The CVSS v3.1 base score is 4.7 (medium severity) with attack vector network, low attack complexity, no privileges required, and user interaction required. The impact is limited to partial confidentiality loss without integrity or availability impact. Oracle has acknowledged the vulnerability but has not published a specific patch or official remediation at this time. The vendor advisory references a general Oracle security alerts page listing CVEs for open source projects but does not provide direct remediation details for this CVE.

Successful exploitation can lead to Oracle Macaron Tool failing to properly validate host addresses, potentially allowing an attacker to compromise the tool's security posture. The impact is limited to partial confidentiality loss; integrity and availability are not affected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the Oracle advisory page for current remediation guidance: https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html. Since no official fix or workaround is currently published, users should monitor Oracle's advisories for updates. Until a patch is available, restricting network access to the affected service and applying network-level controls to limit HTTP exposure may reduce risk.