This vulnerability affects Oracle Application Testing Suite version 13.3.0.1 and permits an unauthenticated attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data or full access to all data accessible by the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be executed remotely with low complexity. The vulnerability is classified under CWE-284 (Improper Access Control).

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Application Testing Suite 13.3.0.1. This compromises confidentiality and integrity of the data but does not impact availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Refer to Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.