What is the CVSS score of CVE-2026-34279?

CVE-2026-34279 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-34279?

Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) can be fully compromised through an authentication bypass in the Event Management component, enabling attackers to control enterprise…

How to fix or mitigate CVE-2026-34279?

Within 24 hours, audit Enterprise Manager 13.5 and 24.1 Event Management access logs for suspicious activity and immediately restrict EM platform network access to authorized administrative users via firewall segmentation. Within 7 days, isolate affected EM instances from production critical-path systems where feasible, enumerate all downstream dependencies (databases, infrastructure nodes, monitored systems), and establish a communication channel with Oracle support for interim guidance and patch timeline. Within 30 days, deploy continuous monitoring of EM instances using EDR or SIEM correlation, finalize patch-readiness procedures including change windows and rollback plans, and conduct a risk review to determine whether architectural changes (alternative management platforms, geographic isolation) can reduce exposure if Oracle's patch timeline extends beyond your risk threshold.

Oracle Enterprise Manager CVE-2026-34279

EUVD-2026-24356 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-21 oracle

GHSA-42q6-42c2-vcj7

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network HTTP reachable at low complexity, but requires pre-existing high privilege (PR:H); scope change with full CIA impact matches the vendor's 9.1.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:25 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24356

CVE Published

Apr 21, 2026 - 20:35 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Management component, where a high-privileged attacker with HTTP network access can compromise the platform and, due to a scope change, significantly impact additional connected products. The flaw is classed as CWE-306 (Missing Authentication for Critical Function) and tagged as an authentication bypass, carrying a CVSS 3.1 base score of 9.1 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.

Technical ContextAI

Oracle Enterprise Manager (OEM) is Oracle's centralized console for monitoring and administering Oracle databases, middleware, engineered systems, and applications; the Base Platform is the core framework, and the affected Event Management component handles alert/event processing and notification workflows. The CPE cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform confirms the Base Platform as the affected artifact. The root-cause class is CWE-306, Missing Authentication for Critical Function, meaning a security-critical operation is reachable without a proper authentication check; combined with the CVSS scope change (S:C), a successful attack escapes the security authority of OEM itself to affect additional managed products.

RemediationAI

Apply the Oracle Critical Patch Update of April 2026, which addresses this issue for the affected Oracle Enterprise Manager Base Platform 13.5 and 24.1 releases; the advisory at https://www.oracle.com/security-alerts/cpuapr2026.html is the authoritative source for exact patch/bundle numbers, as no single fix version string is provided in the source data (Patch available per vendor advisory). Until the CPU is applied, restrict network reachability of the OEM console and its HTTP endpoints to trusted administrative networks only (management VLAN, VPN, or jump host), tightly limit and audit accounts that hold high OEM privileges since exploitation requires PR:H, and monitor the Event Management component and OEM admin activity for anomalous requests. Trade-offs: network restriction can disrupt distributed monitoring agents or remote administrators, and aggressive account restriction may impede legitimate operations, so validate against your OEM topology before enforcing.