CVE-2026-83149 is a critical security vulnerability in Oracle Application Testing Suite version 13.3.0.1. The flaw allows an attacker with low privileges and network access via HTTP to escalate privileges and compromise the application, resulting in unauthorized access to critical data, unauthorized update/insert/delete operations on accessible data, and partial denial of service. The vulnerability affects the confidentiality, integrity, and availability of the system, with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L). Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized access to critical data within Oracle Application Testing Suite, unauthorized modification of some data, and partial denial of service conditions. The vulnerability impacts confidentiality (high), integrity (low), and availability (low) of the affected system. The scope of impact may extend to additional Oracle products due to the nature of the vulnerability.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Application Testing Suite version 13.3.0.1 should apply the provided patch promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.