This vulnerability affects Oracle Application Testing Suite version 13.3.0.1 and permits an unauthenticated attacker with network access via TCP to compromise the application, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact with no impact on integrity or availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for this version.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Application Testing Suite version 13.3.0.1. There is no reported impact on data integrity or availability. The vulnerability can be exploited remotely without authentication, increasing the risk of data exposure.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch for Oracle Application Testing Suite version 13.3.0.1. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates promptly. Until a patch is confirmed and applied, restrict network access to the affected service to trusted sources only.