{"id":"CVE-2026-35255","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-35255","generatedAt":"2026-10-28T00:51:14.397Z","title":"Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects.","description":"Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle Cloud Native Environment Command Line Interface product via a malicious environment variable. Successful attacks of this vulnerability can result in Oracle Cloud Native Environment Command Line Interface allowing users to execute arbitrary code.","published":"2026-05-06T10:16:20.000Z","lastModified":"2026-10-26T19:10:00.000Z","status":"Analyzed","sourceIdentifier":"secalert_us@oracle.com","cvss":{"version":"3.1","score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"},"cwe":["CWE-94"],"affected":["oracle/cloud native environment command line interface"],"epss":{"score":0.00182,"percentile":0.07692,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html","tags":["Not Applicable"],"source":"secalert_us@oracle.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-35255","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}