This vulnerability affects Oracle Application Testing Suite version 13.3.0.1 and is exploitable remotely without authentication via Oracle Net. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can result in complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is categorized under CWE-284 (Improper Access Control). No specific patch or remediation level is stated in the vendor advisory, but it is included in Oracle's July 2026 Critical Patch Update advisory, which contains numerous security patches. The vendor strongly recommends applying available patches promptly.

An unauthenticated attacker with network access can exploit this vulnerability to take over Oracle Application Testing Suite version 13.3.0.1. This results in full compromise of confidentiality, integrity, and availability of the affected application, potentially allowing complete control over the system and its data.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches for Oracle Application Testing Suite 13.3.0.1 without delay. No alternative mitigations or temporary fixes are specified. Staying current with Oracle's security patches is critical to mitigate this vulnerability.