This vulnerability affects Oracle Application Testing Suite version 13.3.0.1. It allows an attacker with low privileges (specifically, the Load Testing for Web Apps privilege) and network access over HTTPS to compromise the application, potentially resulting in complete takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with the specified privileges and network access can fully compromise Oracle Application Testing Suite 13.3.0.1, leading to complete loss of confidentiality, integrity, and availability of the application. This could allow unauthorized control and manipulation of the application environment.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated without patching or that no action is required. Patch availability is confirmed via the Oracle advisory. Users should refer to the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patching instructions.