Oracle Enterprise Manager CVE-2026-101527

Exploitation requires local logon access to the host where Oracle Enterprise Manager Base Platform executes, plus at least low-privilege credentials on that infrastructure (PR:L) - it is NOT remotely exploitable over the network (AV:L). The flaw resides in the Enterprise Manager Install component and affects versions 13.5 and 24.1. Limiting factors that reduce real-world risk: the attacker must already have interactive/logon access to the EM host, so network segmentation, restricted shell access, and least-privilege local accounts materially constrain who can reach it; however, no special non-default configuration or user interaction is needed once that local access exists.

This is a moderate-priority local privilege/takeover flaw rather than a remotely wormable emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) tells a consistent story: an attacker must already have local logon access (AV:L) and at least low privileges (PR:L) on the host running Oracle Enterprise Manager Base Platform, but once there, exploitation is low-complexity (AC:L), needs no user interaction (UI:N), and yields full confidentiality, integrity, and availability compromise - i.e., product takeover. The description's phrasing ('low privileged attacker with logon to the infrastructure') aligns cleanly with AV:L/PR:L, so there is no network-vs-local conflict here. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no active-exploitation or mass-exploitation signal; the real-world status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation is not observed, it is not automatable (local access gate defeats broad automation), but technical impact is total. Net: a genuine escalation-to-takeover risk on already-reachable hosts that should be patched in the normal Oracle CPU cycle, not a drop-everything remote zero-day.

A low-privileged user - such as a local OS account, a limited operator, or an attacker who has already gained a foothold on the Enterprise Manager host - leverages a flaw in the Enterprise Manager Install component to escalate to full control of the Oracle Enterprise Manager Base Platform. Because complexity is low and no user interaction is required, once local logon is obtained the takeover is reliable. No public exploit code is identified at the time of analysis.