CVE-2026-83150

CVE-2026-83150 is a difficult-to-exploit, unauthenticated vulnerability in Oracle Application Testing Suite (OATS) version 13.3.0.1 that can allow an attacker with logon access to the infrastructure where OATS executes to take over the application. Exploitation is local-attack-vector only (AV:L), requires no privileges, but carries high attack complexity and depends on human interaction from a person other than the attacker, meaning a victim must be socially engineered into triggering the malicious action. A successful attack results in full compromise of OATS with high impacts to confidentiality, integrity, and availability (CVSS 3.1 base score 7.0). Organizations running the affected 13.3.0.1 release in their test/QA environments are at risk, though the practical barrier to exploitation is high. No public proof-of-concept is known, the flaw is not on the CISA KEV list, and there are no reports of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83150 and move off OATS 13.3.0.1 to the patched release. Restrict OS-level accounts and remote access on hosts running OATS to reduce the pool of attackers with the required infrastructure logon. Train admins and QA staff to be suspicious of unsolicited links or actions, since the attack chain depends on tricking a legitimate user into interacting with attacker-crafted content.