The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
STARTING SOONSamsung Galaxy Unpacked July 2026IN 3HOpen coverage →
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Fact-check summary

NVD and Oracle's July 2026 CPU advisory confirm the critical CVE-2026-35290 in Application Testing Suite 13.3.0.1, with matching details on impact and scoring.

Sourcing
1source

via NVD

NVD · track record
7Stories
100%Verified
730d
All sources →
Markets
ORCL···

Live quote · not investment advice

Home/Tech/Oracle Application Testing Suite Hit by Critical CVE-2026-35290
VERIFIEDBy Xavier Rivera· ·1 min read

Oracle Application Testing Suite Hit by Critical CVE-2026-35290

Oracle disclosed CVE-2026-35290, a critical unauthenticated remote code execution flaw in Application Testing Suite 13.3.0.1 that allows full takeover via TCP. The CVSS 9.8 vulnerability was published July 21, 2026 and referenced in Oracle's July CPU advisory.

Source:NVD
Post
Oracle Application Testing Suite Hit by Critical CVE-2026-35290
TL;DRAI · 60 sec read

Oracle disclosed a critical vulnerability CVE-2026-35290 in Application Testing Suite version 13.3.0.1. The flaw carries a CVSS score of 9.8 and allows a remote unauthenticated attacker to fully compromise the software. It impacts confidentiality, integrity, and availability. The vulnerability is rated critical under CVSS 3.1. Users should consult Oracle's July 2026 CPU advisory immediately.

Oracle has disclosed a critical vulnerability in its Application Testing Suite that carries a CVSS score of 9.8.

A remote unauthenticated attacker can fully compromise the affected software. The flaw, tracked as CVE-2026-35290, impacts the supported version 13.3.0.1. It allows an attacker with network access via TCP to take over the Oracle Application Testing Suite without authentication or user interaction.
A remote unauthenticated attacker can fully compromise the affected software.
Successful exploitation results in impacts to confidentiality, integrity, and availability.

The vulnerability is rated critical under CVSS 3.1. Oracle assigned a base score of 9.8 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The National Vulnerability Database published the record on July 21, 2026, one day before today's date of July 22, 2026.
From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →
The NVD entry states the vulnerability was received from Oracle and added to the CVE list on July 21, 2026 at 6:17:01 PM.
Users of the affected version should consult Oracle's advisory immediately.
Oracle published details in its July 2026 CPU advisory. The official reference is the security alert located at https://www.oracle.com/security-alerts/cpujul2026.html. The affected product is listed as Oracle Application Testing Suite version 13.3.0.1 with semver status marked affected.

No additional versions or mitigations are detailed in the NVD record. The entry notes that CVSS 4.0 and 2.0 assessments have not yet been provided by NVD.
Users of the affected version should consult Oracle's advisory immediately. The disclosure follows Oracle's standard CPU process for addressing vulnerabilities in its product line.

EXPERT TAKE

Enterprise teams running Oracle Application Testing Suite 13.3.0.1 should treat this CVSS 9.8 remote takeover as an immediate patching priority given the network-accessible unauthenticated attack vector.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
OracleVulnerabilitySecurity
More fromNVD
  • lmdeploy's OpenAI API Server Exposed to SSRF via Redirects

    Tech · 15h
  • SolarWinds Serv-U Hit by Critical IDOR Flaw CVE-2026-28302

    Tech · 20h
  • SigNoz 0.133.0 Open Redirect Lets Attackers Steal SSO Tokens

    Tech · 4d
More inTech
  • Samsung Hosts Galaxy Unpacked Event July 22, 2026

    Tech · 3m
  • lmdeploy's OpenAI API Server Exposed to SSRF via Redirects

    Tech · 15h
  • Apple tests AI for Genius Bar, sends letters to ex-staff at OpenAI

    Tech · 20h
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
SubscribeCircuitry Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Free forever.

MORE IN TECH

Samsung Hosts Galaxy Unpacked Event July 22, 2026

Samsung is presenting new smartphones including the anticipated Galaxy Z Fold 8 and smartwatches at its Galaxy Unpacked event on July 22, 2026. The live stream begins at 15:00 on YouTube and Twitch amid an ongoing RAM crisis that is expected to drive price increases.

lmdeploy's OpenAI API Server Exposed to SSRF via Redirects

lmdeploy's OpenAI-compatible API server is affected by an SSRF flaw (CVE-2026-63764, CVSS 9.3) that lets unauthenticated attackers reach internal services and cloud metadata endpoints. The issue stems from following HTTP 302 redirects without re-checking each hop against the URL safety guard and was added to the NVD on July 21, 2026.

Apple tests AI for Genius Bar, sends letters to ex-staff at OpenAI

A July 21, 2026 recap highlights Apple's testing of an AI note-taking system for Genius Bar use, scrapped Intel Mac Pro plans, legal letters to ex-employees at OpenAI, and up to 11% iPhone price hikes in Japan. These stories reflect ongoing AI development, hardware strategy shifts, talent retention efforts, and market pricing dynamics.