CVE-2016-0487: Oracle Application Testing Suite ActionServlet authentication bypass via directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is remotely exploitable without authentication and has a very high EPSS score, but it is not in KEV and the exact mechanism is disputed, so it warrants prompt patching rather than emergency response.

What it is

Oracle Application Testing Suite (Test Manager for Web Apps) in Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 contains an unspecified vulnerability that Oracle rates as affecting confidentiality and integrity. Third-party researchers claim it is a directory traversal in the process method of the ActionServlet servlet that lets remote attackers bypass authentication. Oracle has not confirmed the third-party description, so the exact mechanism remains unverified.

Impact

An unauthenticated remote attacker can bypass authentication and reach functionality that should require login, gaining partial read and write access to application data. The CVSS 2.0 score of 6.4 reflects partial confidentiality and integrity impact with no availability impact.

Attack surface

Reachable over the network via HTTP against the Oracle Application Testing Suite web interface; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The claimed vector is directory traversal sequences appended to an unspecified URI handled by the ActionServlet process method.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high at 0.50888 (98.9th percentile), and references include a Zero Day Initiative advisory, indicating coordinated disclosure of a working exploit path, but no public exploit code is confirmed in this record.

What to do

• Apply the January 2016 Oracle Critical Patch Update for Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2, which is the vendor patch reference in this record.
• If patching cannot be done immediately, restrict network access to the Oracle Application Testing Suite web interface to trusted management networks only.
• Place the application behind a reverse proxy or WAF and block requests containing directory traversal sequences such as ../ and encoded variants.
• Review and disable any unnecessary Test Manager for Web Apps functionality until the patch is applied.
• Monitor Oracle security advisories for updated guidance, since Oracle has not commented on the third-party vulnerability description.

Detection

• Inspect web server and application logs for requests to ActionServlet containing ../, ..%2f, or other traversal encodings.
• Alert on successful responses to unauthenticated requests that would normally require a session, especially from unexpected source IPs.
• Correlate HTTP access logs with authentication logs to find requests reaching protected resources without a prior login event.
• Hunt for anomalous URI patterns or parameter values targeting the Test Manager for Web Apps endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.