CVE-2026-35255

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35255", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-04-01T20:03:40.834Z", "datePublished": "2026-05-06T08:05:59.070Z", "dateUpdated": "2026-05-06T13:01:24.072Z"}, "containers": {"cna": {"affected": [{"product": "Oracle Cloud Native Environment Command Line Interface", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "v2.3.2"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface\u00a0allowing users to execute arbitrary code."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Vulnerability in the Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface\u00a0allowing users to execute arbitrary code.", "lang": "en", "type": "text"}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-05-06T08:05:59.070Z"}, "references": [{"name": "Oracle Advisory", "tags": ["vendor-advisory"], "url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T13:00:50.089435Z", "id": "CVE-2026-35255", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:01:24.072Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35255", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T13:00:50.089435Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:01:20.018Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Cloud Native Environment Command Line Interface", "versions": [{"status": "affected", "version": "v2.3.2"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface\u00a0allowing users to execute arbitrary code."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Vulnerability in the Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface\u00a0allowing users to execute arbitrary code."}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-05-06T08:05:59.070Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35255", "state": "PUBLISHED", "dateUpdated": "2026-05-06T13:01:24.072Z", "dateReserved": "2026-04-01T20:03:40.834Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2026-05-06T08:05:59.070Z", "assignerShortName": "oracle"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Oracle Cloud Native Environment Command Line Interface", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "v2.3.2"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:cloud_native_environment_command_line_interface:2.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "9B7373D8-06AF-48A0-9D06-14CD6E99E7F5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle\u00a0Cloud Native Environment Command Line Interface\u00a0product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface\u00a0allowing users to execute arbitrary code."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Cloud Native Environment Command Line Interface de Oracle Open Source Projects. Las versiones compatibles que se ven afectadas son la v2.3.2. Vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado comprometer el producto Oracle Cloud Native Environment Command Line Interface a trav\u00e9s de una variable de entorno maliciosa. Ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle Cloud Native Environment Command Line Interface permita a los usuarios ejecutar c\u00f3digo arbitrario."}], "id": "CVE-2026-35255", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.2, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35255", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T13:00:50.089435Z", "version": "2.0.3"}}]}, "published": "2026-05-06T10:16:19.827", "references": [{"source": "secalert_us@oracle.com", "tags": ["Not Applicable"], "url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v2.3.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Oracle Cloud Native Environment Command Line Interface", "source": "cna", "vendor": "Oracle Corporation"}, "product": "cloud_native_environment_command_line_interface", "vendor": "oracle"}], "created": "2026-05-06T11:30:26.607538+00:00", "updated": "2026-05-07T21:25:56.719120+00:00", "vendors": ["oracle", "oracle$PRODUCT$cloud_native_environment_command_line_interface"]}