This vulnerability affects Oracle Application Testing Suite version 13.3.0.1. An attacker with low privileges and the Load Testing for Web Apps privilege who can access the application over HTTPS may exploit this flaw to compromise the Oracle Application Testing Suite. The CVSS 3.1 base score is 7.5, indicating high impact on confidentiality, integrity, and availability. The vulnerability is considered difficult to exploit due to the required privileges and access conditions. Oracle has published a security advisory referencing this vulnerability as part of their August 2026 Critical Security Patch Update, which includes numerous patches across Oracle products. However, no explicit patch or fix version for this specific vulnerability is detailed in the advisory content provided.

Successful exploitation can result in complete takeover of the Oracle Application Testing Suite, impacting confidentiality, integrity, and availability of the system. The attacker requires network access via HTTPS and the Load Testing for Web Apps privilege, which limits the attack surface but still poses a significant risk if those conditions are met.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update process. Although no specific patch version for this vulnerability is explicitly stated in the advisory, customers should monitor Oracle's official security alerts and apply the latest available patches for Oracle Application Testing Suite version 13.3.0.1 or later. Maintaining up-to-date software and restricting the Load Testing for Web Apps privilege to trusted users will help mitigate risk.