CVE-2026-35254

Vulnerability in the Oracle OCI CLI product of Oracle Open Source Projects. The supported versions that is affected is 3.77. Easily exploitable vulnerability allows unauthenticated attacker with network access to compromise Oracle OCI CLI. Successful attacks of this vulnerability can result in Oracle OCI CLI allowing users to place imported files outside the intended directory.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:cloud_infrastructure_cli:3.77:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle OCI CLI de Oracle Open Source Projects. Las versiones compatibles que se ven afectadas son la 3.77. Una vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red comprometer Oracle OCI CLI. Los ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle OCI CLI permita a los usuarios colocar archivos importados fuera del directorio previsto.

Information

Published : 2026-05-06 08:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-35254

Mitre link : CVE-2026-35254

CVE.ORG link : CVE-2026-35254

JSON object : View

Products Affected

oracle

cloud_infrastructure_cli

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-35254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T13:01:57.543020Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle OCI CLI of Oracle Open Source Projects", "versions": [{"status": "affected", "version": "3.77.0"}]}]}], "published": "2026-05-06T08:16:03.697", "references": [{"url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html", "tags": ["Not Applicable"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle OCI CLI product of Oracle Open Source Projects. The supported versions that is affected is 3.77. Easily exploitable vulnerability allows unauthenticated attacker with network access to compromise Oracle OCI CLI. Successful attacks of this vulnerability can result in Oracle OCI CLI allowing users to place imported files outside the intended\u00a0directory."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle OCI CLI de Oracle Open Source Projects. Las versiones compatibles que se ven afectadas son la 3.77. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red comprometer Oracle OCI CLI. Los ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle OCI CLI permita a los usuarios colocar archivos importados fuera del directorio previsto."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:cloud_infrastructure_cli:3.77:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BD5ED05-366E-4131-8526-3F2D62AA75EE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}