CVE-2026-35255 affects Oracle Cloud Native Environment Command Line Interface version 2.3.2. The vulnerability allows an unauthenticated attacker to execute arbitrary code by supplying a malicious environment variable. The CVSS 3.1 vector indicates the attack requires local access with low complexity and low privileges but user interaction is required. The impact includes high confidentiality and integrity impact but no availability impact. The vendor advisory does not provide explicit patch or mitigation details for this vulnerability, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to arbitrary code execution within the Oracle Cloud Native Environment CLI context, potentially compromising confidentiality and integrity of the affected system. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the Oracle vendor advisory for current remediation guidance at https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html. No official fix or temporary workaround is currently documented publicly. Users should monitor Oracle advisories for updates and consider restricting local access to affected versions until a patch is available.