CVE-2026-35255 MEDIUM

CVE-2026-35255

Vendor Oracle Corporation
Product Oracle Cloud Native Environment Command Line Interface
Published May 6, 2026
Last update May 6, 2026
View on NVD All CVEs

CVSS base score

6.6/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle Cloud Native Environment Command Line Interface product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface allowing users to execute arbitrary code.

Key dates

02Disclosure timeline

May 6, 2026 CVE published
May 6, 2026 Record updated