{"cve":"CVE-2026-70862","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"13.3.0.1"}}],"enrichment":{"confidence":95.0,"confidence_source":"inferred","scores":[{"score":95.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Oracle Application Testing Suite","source":"cna","vendor":"Oracle Corporation"},"product":"application_testing_suite","vendor":"oracle"}],"created":"2026-08-19T03:30:17.256259+00:00","title":"Unauthenticated HTTP Access Allows Full Data Compromise in Oracle Application Testing Suite","updated":"2026-08-24T23:45:17.481705+00:00","vendors":["oracle","oracle$PRODUCT$application_testing_suite"]},"epss":{"score":0.00425},"mitre":{"cpes":["cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"],"created":"2026-08-18T21:02:13.102000+00:00","description":"Vulnerability in Oracle Application Testing Suite.   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/70xxx/CVE-2026-70862.json","references":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"title":null,"updated":"2026-08-24T14:21:25.883000+00:00","vendors":["oracle","oracle$PRODUCT$application_testing_suite"],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"],"created":"2026-08-18T21:17:42.370000+00:00","description":"Vulnerability in Oracle Application Testing Suite.   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-70862.json","references":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"title":null,"updated":"2026-08-27T18:37:34.330000+00:00","vendors":["oracle","oracle$PRODUCT$application_testing_suite"],"weaknesses":["CWE-284"]},"opencve":{"changes":[{"created":"2026-08-18T21:15:00+00:00","data":[{"details":{"new":"Vulnerability in Oracle Application Testing Suite.   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","old":null},"type":"description"},{"details":["oracle","oracle$PRODUCT$application_testing_suite"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["oracle","oracle$PRODUCT$application_testing_suite"],"removed":[]},"type":"vendors"},{"details":{"added":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"53f59ad8-7ab4-4eba-bdbe-190d655c1bc0"},{"created":"2026-08-19T03:45:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP Access Fault Lets Attackers Modify All Data in Oracle Application Testing Suite","old":null},"type":"title"},{"details":{"added":["CWE-284","CWE-285"],"removed":[]},"type":"weaknesses"}],"id":"afe2dc48-72ff-4e6f-aa3c-a775e51224c8"},{"created":"2026-08-21T04:45:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated HTTP Access Fault Lets Attackers Modify All Data in Oracle Application Testing Suite"},"type":"title"},{"details":{"added":[],"removed":["CWE-284","CWE-285"]},"type":"weaknesses"}],"id":"8a8a1374-7779-4da8-b02e-35f6f8457750"},{"created":"2026-08-21T05:45:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Application Testing Suite","old":null},"type":"title"},{"details":{"added":["CWE-862"],"removed":[]},"type":"weaknesses"}],"id":"acf792bc-0ddb-4d95-8843-5d37c46b9c55"},{"created":"2026-08-24T15:30:00+00:00","data":[{"details":{"added":["CWE-284"],"removed":[]},"type":"weaknesses"},{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"be765058-48ff-4494-b39e-932252082ede"},{"created":"2026-08-24T22:15:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Application Testing Suite"},"type":"title"},{"details":{"added":[],"removed":["CWE-862"]},"type":"weaknesses"}],"id":"fce1b8e6-8a28-45e3-a70b-ef45ec50032d"},{"created":"2026-08-25T00:00:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP Access Allows Full Data Compromise in Oracle Application Testing Suite","old":null},"type":"title"}],"id":"677c05b5-0ca5-4ee1-99f0-5f25096027a9"}],"cpes":{"data":["cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"],"providers":["mitre","nvd"]},"created":{"data":"2026-08-18T21:02:13.102000+00:00","provider":"mitre"},"description":{"data":"Vulnerability in Oracle Application Testing Suite.   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00425},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"providers":["mitre","nvd"]},"title":{"data":"Unauthenticated HTTP Access Allows Full Data Compromise in Oracle Application Testing Suite","provider":"enrichment"},"updated":{"data":"2026-08-24T23:45:17.481705+00:00","provider":"enrichment"},"vendors":{"data":["oracle","oracle$PRODUCT$application_testing_suite"],"providers":["mitre","nvd","enrichment"]},"weaknesses":{"data":["CWE-284"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2026-08-18T21:02:13.102000+00:00","description":"Vulnerability in Oracle Application Testing Suite.   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Application Testing Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2026-08-24T13:41:21.423000+00:00","vendors":[],"vulnrichment_repo_path":"2026/70xxx/CVE-2026-70862.json","weaknesses":["CWE-284"]}}