Oracle Application Testing Suite: Unspecified vulnerability in OpenScript
Summary
Oracle Application Testing Suite version 13.3.0.1, specifically its OpenScript component, is affected by a vulnerability rated CVSS 7.8 (High) by Oracle. An attacker with low privileges and a logon to the host where the suite runs can compromise the application, with high impact on confidentiality, integrity and availability. The attack is local and requires no user interaction; the vulnerability type is not specified in the available data, and the NVD record was still awaiting analysis at the time of collection.
Affected
- Oracle Application Testing Suite 13.3.0.1 (OpenScript component)
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fixed in
Unknown. Oracle's October 2026 Critical Patch Update contains security patches for Oracle Application Testing Suite. The fixed build number was not found in the sources; check the Patch Availability Document on My Oracle Support.
Workaround
No vendor workaround found.
- Until patched, limit interactive logons on OATS hosts to named administrators.
- Remove unused accounts and do not share OATS hosts with untrusted users.
- Do not expose OATS hosts to the internet.
Exploitation
- No confirmed exploitation in the wild.
- A third-party aggregator lists it as not in CISA KEV; this was not verified against the KEV catalogue.
- No public proof of concept found in our searches.
Our recommendation
- Confirm whether Oracle Application Testing Suite 13.3.0.1 is installed, including OpenScript.
- Obtain the October 2026 CPU patch for the product from My Oracle Support using the Patch Availability Document.
- Test the patch on a non-production instance first, then apply it.
- Review accounts with logon rights on OATS hosts.
- Check CISA KEV and vendor sources again before closing the ticket.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle October 2026 Critical Patch Update Advisory www.oracle.com
- Oracle October 2026 CPU Verbose Advisory www.oracle.com
- Oracle September 2026 CPU Advisory (Patch Availability Document reference) www.oracle.com
- VulDB entry for CVE-2026-101549 vuldb.com
- Vulners NVD mirror entry for CVE-2026-101549 vulners.com
- SecurityWeek: Oracle patches over 1,200 vulnerabilities with October 2026 CPU www.securityweek.com
- Tenable: Oracle October 2026 Critical Patch Update www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:27.
Original description (NVD)
Vulnerability in Oracle Application Testing Suite (component: OpenScript). The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.