CVE-2026-35255

Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle Cloud Native Environment Command Line Interface product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface allowing users to execute arbitrary code.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:cloud_native_environment_command_line_interface:2.3.2:*:*:*:*:*:*:*

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle Cloud Native Environment Command Line Interface de Oracle Open Source Projects. Las versiones compatibles que se ven afectadas son la v2.3.2. Vulnerabilidad fácilmente explotable permite a un atacante no autenticado comprometer el producto Oracle Cloud Native Environment Command Line Interface a través de una variable de entorno maliciosa. Ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle Cloud Native Environment Command Line Interface permita a los usuarios ejecutar código arbitrario.

Information

Published : 2026-05-06 10:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-35255

Mitre link : CVE-2026-35255

CVE.ORG link : CVE-2026-35255

JSON object : View

Products Affected

oracle

cloud_native_environment_command_line_interface

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-35255", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35255", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T13:00:50.089435Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.3}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Cloud Native Environment Command Line Interface", "versions": [{"status": "affected", "version": "v2.3.2"}]}]}], "published": "2026-05-06T10:16:19.827", "references": [{"url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html", "tags": ["Not Applicable"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface\u00a0allowing users to execute arbitrary code."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Cloud Native Environment Command Line Interface de Oracle Open Source Projects. Las versiones compatibles que se ven afectadas son la v2.3.2. Vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado comprometer el producto Oracle Cloud Native Environment Command Line Interface a trav\u00e9s de una variable de entorno maliciosa. Ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle Cloud Native Environment Command Line Interface permita a los usuarios ejecutar c\u00f3digo arbitrario."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:cloud_native_environment_command_line_interface:2.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B7373D8-06AF-48A0-9D06-14CD6E99E7F5"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}