This vulnerability affects Oracle Application Testing Suite version 13.3.0.1 and can be exploited by an unauthenticated attacker who has physical access to the communication segment connected to the hardware running the suite. Exploitation can result in unauthorized access to critical or all data accessible by the suite and unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector indicates attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory references a Critical Security Patch Update released in August 2026 but does not explicitly state a patch for this vulnerability.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Application Testing Suite and unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the data handled by the suite. There is no reported impact on availability. The attack requires physical access to the communication segment, limiting remote exploitation.

Oracle strongly recommends applying security patches promptly and staying on actively supported versions. The August 2026 Critical Security Patch Update advisory references many patches but does not explicitly confirm a patch for this vulnerability. Therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation guidance. Until a patch is applied, restrict physical access to the communication segments attached to the hardware running Oracle Application Testing Suite to mitigate risk.