Vulnerabilities ›

CVE-2026-35255

Medium

                    Published: May 6, 2026                      ·  Modified: May 6, 2026                      ·  Source: NVD                

CVSS v3

6.6

🔗 NVD Official

📄 Description (English)

Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle Cloud Native Environment Command Line Interface product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface allowing users to execute arbitrary code.

🤖 AI Executive Summary

CVE-2026-35255 is a medium-severity vulnerability in Oracle Cloud Native Environment CLI v2.3.2 that allows unauthenticated attackers to execute arbitrary code through malicious environment variables. Organizations using this tool should immediately update to patched versions to prevent unauthorized code execution.

📄 Description (Arabic)

تؤثر هذه الثغرة على إصدار v2.3.2 من واجهة سطر الأوامر الأصلية لـ Oracle Cloud Native Environment، مما يسمح للمهاجمين غير المصرح لهم بتنفيذ كود عشوائي من خلال متغيرات البيئة الضارة. يمكن للمهاجمين استغلال هذه الثغرة بسهولة دون الحاجة إلى بيانات اعتماد المصادقة.

🤖 ملخص تنفيذي (AI)

This vulnerability affects Oracle Cloud Native Environment CLI v2.3.2, enabling unauthenticated attackers to execute arbitrary code via environment variable manipulation. Saudi organizations deploying this CLI tool must urgently patch systems to mitigate remote code execution risks.

🤖 AI Intelligence Analysis Analyzed: May 10, 2026 21:16

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

government telecom banking energy

🎯 MITRE ATT&CK Techniques

T1547.001 T1059.001 T1203

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Update Oracle Cloud Native Environment CLI to the latest patched version beyond v2.3.2 immediately. Review and restrict environment variable configurations in deployment pipelines. Implement principle of least privilege for CLI tool execution and monitor for suspicious environment variable modifications.

🔧 خطوات المعالجة (العربية)

قم بتحديث واجهة سطر الأوامر الأصلية لـ Oracle Cloud إلى أحدث إصدار مصحح فوراً. راجع وقيد تكوينات متغيرات البيئة في خطوط النشر. طبق مبدأ أقل امتياز لتنفيذ أدوات CLI ومراقبة التعديلات المريبة على متغيرات البيئة.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

A.7.1 A.8.1 A.12.2

🔵 SAMA CSF

ID.BE-1 PR.IP-1 PR.IP-2 DE.CM-1

🟡 ISO 27001:2022

A.6.1.1 A.12.2.1 A.14.2.1

🔗 References & Sources 1

🔗

https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-docu...

secalert_us@oracle.com

📊 CVSS Score

6.6

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionR — Required

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityN — None / Network

📋 Quick Facts

Severity Medium

CVSS Score6.6

EPSS0.04%

Exploit No

Patch ✗ No

Published 2026-05-06

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-35255

💬 Comments

Introduce Yourself

Sign In Required