---
id: "CVE-2026-101549"
kind: "vulnerability"
aliases: ["CVE-2026-101549"]
title: "Oracle Application Testing Suite: OpenScript flaw lets a local low-privilege user take over"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Application Testing Suite", "fixed": [], "affected": "13.3.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["local-privilege-escalation", "openscript", "oracle", "oracle-application-testing-suite", "other"]
not_affected_if: ["no-local-logon", "other-versions"]
published_at: "2026-10-20T22:18:04+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:26:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101549", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:26:54+00:00"}]
---

# Oracle Application Testing Suite: OpenScript flaw lets a local low-privilege user take over

Oracle Application Testing Suite's OpenScript component has a flaw that lets a low-privileged user who can log on to the host take over the suite. The CVSS vector rates it as local access with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Application Testing Suite affected 13.3.0.1 fixed ?

## How to check

- Check the installed Oracle Application Testing Suite version; 13.3.0.1 is the only version Oracle lists as affected.
- Check whether the October 2026 CPU patch for OATS is applied (OPatch inventory on the host).
- Check who has OS logon to the host; the flaw needs a local account.

## Fix

Apply the Oracle Application Testing Suite patch from the October 2026 Critical Patch Update (see the Patch Availability Document linked from the advisory; needs a My Oracle Support login). Oracle does not publish a fixed version number on the public page.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101549
- 2026-10-25T03:26:54+00:00 analyst — Oracle CPU Oct 2026 (primary) lists Application Testing Suite 13.3.0.1 as affected; patch is delivered via the CPU's Patch Availability Document (MOS, login required), no fixed version number published openly. No exploitation or PoC found. Sibling CVE-2026-101548 same component, AC:H 7.0.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html

## From the sources

Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_