CVE-2026-35254

{
  "id": "CVE-2026-35254",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-06T08:16:03.697",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle OCI CLI product of Oracle Open Source Projects. The supported versions that is affected is 3.77. Easily exploitable vulnerability allows unauthenticated attacker with network access to compromise Oracle OCI CLI. Successful attacks of this vulnerability can result in Oracle OCI CLI allowing users to place imported files outside the intended directory."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Oracle OCI CLI de Oracle Open Source Projects. Las versiones compatibles que se ven afectadas son la 3.77. Una vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red comprometer Oracle OCI CLI. Los ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle OCI CLI permita a los usuarios colocar archivos importados fuera del directorio previsto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle OCI CLI of Oracle Open Source Projects",
          "versions": [
            {
              "version": "3.77.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-06T13:01:57.543020Z",
          "id": "CVE-2026-35254",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:cloud_infrastructure_cli:3.77:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BD5ED05-366E-4131-8526-3F2D62AA75EE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    }
  ]
}