Oracle Enterprise Manager CVE-2026-101511

Exploitation requires network access over HTTP to the Oracle Enterprise Manager Base Platform console and a valid low-privileged account on that platform (CVSS PR:L) - it is NOT remotely exploitable by an unauthenticated attacker. The specific affected feature is the Metadata Plugin component on supported versions 13.5 and 24.1. Limiting factors: the attacker must first obtain authenticated access to Enterprise Manager; impact is confined to unauthorized read access to a subset of accessible data (no integrity or availability impact), and no user interaction by a victim is needed (UI:N).

This is a genuinely moderate-to-low real-world risk, and the signals are consistent rather than conflicting. The CVSS 3.1 base score of 4.3 (MEDIUM) is driven by a network attack vector (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but it is tempered by two important limiters: the attacker must already hold low-level privileges (PR:L) and the only impact is partial confidentiality loss (C:L, with I:N/A:N) - unauthorized read access to a subset of data, no write and no availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' There is a conflict in the input metadata worth flagging: the 'Authentication Bypass' tag directly contradicts the Oracle description and CVSS vector, which require an authenticated low-privileged attacker (PR:L) and describe an information-disclosure flaw, not an auth bypass - this tag appears mislabeled and should not drive prioritization. Overall this is a lower-tier Oracle CPU item: patch in routine cycles rather than as an emergency, prioritized above purely local issues but below unauthenticated RCE.

A user with an existing low-privileged account on the Oracle Enterprise Manager Base Platform sends a crafted HTTP request to the vulnerable Metadata Plugin component and retrieves a subset of data they are not authorized to read. No public exploit code is identified at time of analysis, and because privileges are required (PR:L), the attacker needs valid credentials or an existing foothold on the management console.