PT-2026-37373 · Oracle · Oracle Cloud Native Environment Command Line Interface

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-35255

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oracle Cloud Native Environment Command Line Interface version 2.3.2

Description An issue in the Oracle Cloud Native Environment Command Line Interface allows an unauthenticated attacker to compromise the product by using a malicious environment variable. Successful exploitation can result in arbitrary code execution, which is the ability to run unauthorized commands or software on the target system.

Recommendations Update version 2.3.2 to a patched version.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-35255

Affected Products

Oracle Cloud Native Environment Command Line Interface

References · 7

• https://oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35255 · Security Note
• https://t.me/cveNotify/162298 · Telegram Post
• https://t.me/cveNotify/162355 · Telegram Post
• https://twitter.com/CVEnew/status/2051997185617850757 · Twitter Post
• https://twitter.com/UpwindMDR/status/2052011821066793080 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051998173057413563 · Twitter Post