# CVE-2026-35287: Oracle Application Testing Suite Information Disclosure

Source: https://junglewise.ai/threats/cve-2026-35287-oracle-application-testing-suite-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-35287 · Severity: high · CVSS 7.5 · Published 2026-07-21

A vulnerability in the Oracle Application Testing Suite allows an unauthorized person to access sensitive information over the network. This software is used by organizations to automate the testing of web and packaged applications. An exploit could lead to the exposure of critical business data or complete access to all data managed within the testing suite, potentially compromising software development lifecycles and proprietary application details.

Technologies: [Oracle Application Testing Suite](https://junglewise.ai/threats/technologies/application-testing-suite). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-35287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35287 being exploited in the wild.

**How severe is CVE-2026-35287?** High severity, with a CVSS score of 7.5, published 21 July 2026.

**Which products and versions are affected?** Oracle Application Testing Suite 13.3.0.1.

**Is there a fix for CVE-2026-35287?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-35287 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35287?** Check whether you run Oracle Application Testing Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Oracle Application Testing Suite version 13.3.0.1. The flaw is easily exploitable by an unauthenticated attacker with network access via TCP. Successful exploitation allows the attacker to bypass confidentiality controls, resulting in unauthorized access to critical data or complete access to all data accessible by the suite. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high confidentiality impact with no impact on integrity or availability. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.

## Affected products

- Oracle Application Testing Suite 13.3.0.1

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: advisory: NVD publication date

## References

- [https://www.oracle.com/security-alerts/cpujul2026.html](https://www.oracle.com/security-alerts/cpujul2026.html)

## Related threats

- [Oracle Application Testing Suite privilege escalation in OpenScript](https://junglewise.ai/threats/cve-2026-101549-vulnerability-in-oracle-application-testing-suite-component)
- [Oracle Application Testing Suite privilege escalation in OpenScript](https://junglewise.ai/threats/cve-2026-101548-vulnerability-in-oracle-application-testing-suite-component)
- [Oracle Application Testing Suite privilege escalation](https://junglewise.ai/threats/cve-2026-83150-oracle-application-testing-suite-privilege-escalation)
- [Oracle Application Testing Suite privilege escalation via HTTP](https://junglewise.ai/threats/cve-2026-83149-oracle-application-testing-suite-privilege-escalation-via-http)
- [Oracle Application Testing Suite privilege escalation](https://junglewise.ai/threats/cve-2026-83148-oracle-application-testing-suite-privilege-escalation)