EUVD-2026-37347Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP reach with a low-privileged OEM account suffices (AV:N, AC:L, PR:L, UI:N); scope change to managed Oracle products and full takeover give S:C and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Target Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management component) allows a low-privileged attacker with HTTP network access to compromise the platform and impact other Oracle products via scope change. The flaw carries a CVSS 9.9 rating reflecting low attack complexity and broad confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires HTTP/HTTPS reachability to the Oracle Enterprise Manager Base Platform console on a vulnerable 13.5 or 24.1 deployment and a valid low-privilege OEM account (CVSS PR:L), with no user interaction and low attack complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are strongly aligned toward priority remediation: CVSS 3.1 is 9.9 with AV:N, AC:L, PR:L, UI:N, S:C, C:H/I:H/A:H - meaning a single low-privileged OEM account is sufficient for remote, no-interaction exploitation with full impact and cross-component blast radius. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been issued a low-privilege OEM user account - for example via phishing of an operator, reuse of leaked credentials, or an over-permissive self-service role - sends crafted HTTP requests to Target Management endpoints from the corporate network. The scope-changed flaw lets those requests act beyond the attacker's role, taking over the OEM platform and, by pivoting through stored named credentials, reaching managed Oracle databases and middleware; no public exploit identified at time of analysis, but the low complexity makes weaponization straightforward once details emerge. |
| Remediation | Apply the fixes delivered in Oracle's June 2026 Critical Patch Update (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html) to Oracle Enterprise Manager Base Platform 13.5 and 24.1 as soon as the maintenance window permits; an exact fixed build number is not in the supplied data and must be taken directly from the CPU matrix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker v
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata P
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network a
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker ov
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library comp
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authe
Authenticated takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Agent Next Gen compo
Remote denial-of-service and data tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthentica
Privileged local compromise in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Extensibility Framework component)
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible by an authenticated, high-
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today