Oracle Enterprise Manager CVE-2026-101528

Exploitation requires network HTTP access to an Oracle Enterprise Manager for Oracle Database console (version 13.5 or 24.1) AND a valid low-privileged account on that console (CVSS PR:L) - it is NOT unauthenticated. The vulnerable surface is specifically the Data Guard Management component, so instances using Data Guard management functionality are the relevant attack surface. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the authentication requirement (any low-privilege credential or foothold) and reachability of the OEM HTTP interface; the risk is highest where OEM is broadly accessible or internet-exposed. The confirmed scope change (S:C) means a successful attack can propagate impact to the managed Oracle Database estate and additional products beyond OEM itself.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) is internally consistent with the description: network-reachable over HTTP, low attack complexity, only a low-privilege account required, no user interaction, and a scope change that Oracle explicitly confirms ('attacks may significantly impact additional products'). The combination of a scope change with full C/I/A impact and complete 'takeover' of Oracle Enterprise Manager for Oracle Database is why the score sits at 9.9 rather than lower. Key exploitation signals are MISSING, however, and this must limit confidence: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - the only source is the Oracle Critical Patch Update advisory. Therefore exploitation is characterized as 'no public exploit identified at time of analysis.' Note also a conflicting signal in the input metadata: the CVE is tagged 'Information Disclosure,' but Oracle's own impact ratings (C:H/I:H/A:H plus product takeover) describe far more than disclosure - the tag understates the true impact and should not be relied upon. The PR:L requirement (a valid low-privilege account on the management console) is the main real-world mitigating factor; against an internet-exposed or broadly-accessible OEM instance with any foothold, this is a strong candidate for prioritized patching in the October 2026 CPU cycle.

An attacker holding any low-privileged account on an Oracle Enterprise Manager for Oracle Database console (13.5 or 24.1) sends crafted HTTP requests to the Data Guard Management component to escalate into a full takeover of OEM. Because of the confirmed scope change, the compromise extends beyond OEM itself to the managed Oracle Database estate and related products. No public exploit code is identified at time of analysis, but the low complexity and low privilege bar make exploitation straightforward once access is obtained.