CVE-2016-0491: Oracle Application Testing Suite file upload flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityPublic exploit code and a very high EPSS score make exploitation likely, though the flaw is not in KEV and Oracle has not confirmed the third-party RCE detail.

What it is

Oracle Application Testing Suite (Load Testing for Web Apps) in Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 contains an unspecified flaw affecting integrity and availability. Third-party researchers claim the UploadFileAction servlet lets remote authenticated users upload and execute arbitrary files by placing an asterisk in the fileType parameter, which would yield code execution on the server. Oracle has not confirmed the third-party detail, so the exact mechanism remains partly unverified.

Impact

An attacker who can reach the servlet and authenticate can upload and execute arbitrary files, gaining code execution on the Oracle ATS host and compromising the integrity and availability of the application.

Attack surface

Reachable over the network via HTTP against the Oracle ATS Load Testing for Web Apps component; the NVD vector indicates no authentication (Au:N), while the third-party claim requires an authenticated session, so the record is inconsistent on this point. No user interaction is described.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.79948, 99.59th percentile) and multiple references are tagged Exploit, including Packet Storm, Exploit-DB and a Rapid7 Metasploit module, indicating public exploit code exists.

What to do

• Apply the January 2016 Oracle Critical Patch Update for Oracle Application Testing Suite 12.4.0.2 and 12.5.0.2.
• Restrict network access to the ATS Load Testing servlets, especially UploadFileAction, to trusted management networks.
• Enforce strong authentication and least privilege on ATS accounts, since the claimed vector requires an authenticated session.
• If ATS is not required, decommission or isolate the affected instances until patched.
• Monitor and block uploads of executable file types through the ATS web interface.

Detection

• Alert on POST requests to UploadFileAction with an asterisk or unusual characters in the fileType parameter.
• Monitor the ATS web directories for newly written executable files (JSP, WAR, JAR, scripts) and unexpected file creation.
• Review ATS and web server logs for anomalous upload activity or requests from unfamiliar source addresses.
• Hunt for child processes spawned by the ATS application server that indicate uploaded code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.