PT-2026-37347 · Oracle · Macaron Tool

Published 2026-05-06 · Updated 2026-05-10 · CVE-2026-35253

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Macaron Tool version 0.22.0

Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Macaron Tool. This issue allows the attacker to bypass host address validation, which is the process of verifying that a request originates from a trusted or authorized network address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Origin Validation Error

Weakness Enumeration

CWE-601

CWE-346

Related Identifiers

CVE-2026-35253

Affected Products

Macaron Tool

References · 6

• https://oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35253 · Security Note
• https://t.me/CVEtracker/52817 · Telegram Post
• https://t.me/cveNotify/162295 · Telegram Post
• https://t.me/cveNotify/162957 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051959229699813392 · Twitter Post