{"id":"CVE-2026-101549","kind":"vulnerability","aliases":["CVE-2026-101549"],"related":[],"title":"Oracle Application Testing Suite: OpenScript flaw lets a local low-privilege user take over","description":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Application Testing Suite's OpenScript component has a flaw that lets a low-privileged user who can log on to the host take over the suite. The CVSS vector rates it as local access with full confidentiality, integrity and availability impact.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Application Testing Suite","fixed":[],"affected":"13.3.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["local-privilege-escalation","openscript","oracle","oracle-application-testing-suite","other"],"not_affected_if":["no-local-logon","other-versions"],"how_to_check":"- Check the installed Oracle Application Testing Suite version; 13.3.0.1 is the only version Oracle lists as affected.\n- Check whether the October 2026 CPU patch for OATS is applied (OPatch inventory on the host).\n- Check who has OS logon to the host; the flaw needs a local account.","fix":"Apply the Oracle Application Testing Suite patch from the October 2026 Critical Patch Update (see the Patch Availability Document linked from the advisory; needs a My Oracle Support login). Oracle does not publish a fixed version number on the public page.","status":"open","published_at":"2026-10-20T22:18:04+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:09:57+00:00","updated_at":"2026-10-25T03:26:54+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:09:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Oracle Application Testing Suite: OpenScript flaw lets a local low-privilege user take over","impact":"high","summary":"Oracle Application Testing Suite's OpenScript component has a flaw that lets a low-privileged user who can log on to the host take over the suite. The CVSS vector rates it as local access with full confidentiality, integrity and availability impact.","category":"other","nicknames":[],"who_cares":["oracle","oracle-application-testing-suite","openscript"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged local user takes over the suite, full access","analyst_note":"Find the Oracle Critical Patch Update advisory listing the fixed version for OpenScript in Application Testing Suite 13.3.0.1.","how_to_check":"- Confirm the installed version of Oracle Application Testing Suite; the sources say version 13.3.0.1 is affected.\n- Check whether OpenScript is in use on the host where the suite runs.","needs_analyst":true,"not_affected_if":["other-versions","no-local-logon"],"who_is_affected":"Teams that run Oracle Application Testing Suite version 13.3.0.1 on a shared host where other users can log on. The sources do not say which patch or later version resolves it, so the vendor advisory is needed. Teams that do not run this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3444,"output_tokens":516,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory listing the fixed version for OpenScript in Application Testing Suite 13.3.0.1.","search":"'-101549':17A,20A '-2026':16A,19A '/av':147C '13.3.0.1':94C '3.1':134C,146C '7.8':137C 'access':71B 'affect':92C 'allow':98C 'applic':2A,33B,37B,82C,109C,116C,130C 'application':22A 'attack':101C,120C 'avail':77B,141C 'base':135C 'compon':42B,85C 'compromis':114C 'confidenti':74B,138C 'cve':15A,18A 'cvss':65B,133C,143C,145C 'easili':95C 'escal':28B 'execut':112C 'exploit':96C 'flaw':6A,45B 'full':73B 'h':155C 'h/a':154C 'h/i':153C 'host':59B 'impact':78B,142C 'infrastructur':106C 'integr':75B,139C 'l/ac':148C 'l/pr':149C 'l/ui':150C 'let':7A,47B 'local':9A,26B,70B 'local-privilege-escal':25B 'log':55B 'logon':103C 'low':11A,50B,99C 'low-privileg':10A,49B 'n/s':151C 'openscript':5A,29B,41B,86C 'oracl':1A,30B,32B,36B,81C,108C,115C,129C 'oracle':21A 'oracle-application-testing-suit':31B 'privileg':12A,27B,51B,100C 'rate':67B 'result':125C 'score':136C 'success':119C 'suit':4A,35B,39B,63B,84C,111C,118C,132C 'suite':24A 'support':88C 'take':14A,60B 'takeov':127C 'test':3A,34B,38B,83C,110C,117C,131C 'testing':23A 'u/c':152C 'user':13A,52B 'vector':66B,144C 'version':89C 'vulner':79C,97C,123C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Application Testing Suite 13.3.0.1 (the OpenScript component) on a host where other people or accounts can log on. An attacker needs a low-privileged local account, no user interaction, so it matters most on shared test servers and build or QA machines. Teams that do not run this product, or whose OATS host has no untrusted local logons, can skip it.","tier":"B","verified":{"products":{"at":"2026-10-25T03:26:54Z","by":"analyst","run_id":719}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101549","severity":null,"published_at":"2026-10-20T22:18:04+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101549:719","url":null,"severity":null,"published_at":"2026-10-25T03:26:54+00:00","modified_at":"2026-10-25T03:26:54+00:00","first_seen_at":"2026-10-25T03:26:54+00:00","fetched_at":"2026-10-25T03:26:54+00:00","note":"Oracle CPU Oct 2026 (primary) lists Application Testing Suite 13.3.0.1 as affected; patch is delivered via the CPU's Patch Availability Document (MOS, login required), no fixed version number published openly. No exploitation or PoC found. Sibling CVE-2026-101548 same component, AC:H 7.0."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}