CVE-2026-35255

{
  "id": "CVE-2026-35255",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-06T10:16:19.827",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle Cloud Native Environment Command Line Interface product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface allowing users to execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Oracle Cloud Native Environment Command Line Interface de Oracle Open Source Projects. Las versiones compatibles que se ven afectadas son la v2.3.2. Vulnerabilidad fácilmente explotable permite a un atacante no autenticado comprometer el producto Oracle Cloud Native Environment Command Line Interface a través de una variable de entorno maliciosa. Ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle Cloud Native Environment Command Line Interface permita a los usuarios ejecutar código arbitrario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Cloud Native Environment Command Line Interface",
          "versions": [
            {
              "version": "v2.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-06T13:00:50.089435Z",
          "id": "CVE-2026-35255",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:cloud_native_environment_command_line_interface:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B7373D8-06AF-48A0-9D06-14CD6E99E7F5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    }
  ]
}