EUVD-2026-37357Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged credential
-
DeliveryReach Agent Next Gen SSH port
-
ExploitAuthenticate to vulnerable agent
-
ExecutionExploit Agent Next Gen flaw
-
PersistEscalate to OEM Base Platform takeover
-
ImpactPivot to managed Oracle targets
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Agent Next Gen SSH interface on an Oracle Enterprise Manager Base Platform 13.5 or 24.1 host, plus possession of a low-privileged credential accepted by that SSH path (PR:L per Oracle's CVSS). No user interaction is required (UI:N) and attack complexity is low (AC:L), and Oracle characterizes the bug as 'easily exploitable.' Limiting factors that reduce realistic exposure: the attacker must already hold valid low-privileged credentials, the agent's SSH surface is typically reachable only from the OMS or admin networks in well-segmented deployments, and only the named versions 13.5 and 24.1 are confirmed affected. |
| Impact | Signals are mixed-but-actionable: CVSS 3.1 is 8.8 with AV:N/AC:L/PR:L/UI:N and full C/I/A impact, and Oracle explicitly labels it 'easily exploitable,' which together justify prioritization for any environment running OEM 13.5 or 24.1. Countervailing signals are notable - there is no CISA KEV listing, no EPSS score provided in the input, no public POC observed, and no CWE assignment, which suggests targeted/credentialed risk rather than mass exploitation. The CVSS vector says AV:N but the description constrains the path to 'network access via SSH,' which in many OEM deployments means the agent's SSH surface is reachable only from the OMS or jump hosts; defenders whose Agent Next Gen SSH is not broadly reachable should treat realistic exploitability as lower than the raw 8.8 implies, while defenders exposing OEM management networks broadly should treat it as urgent. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged credential usable against the Agent Next Gen SSH surface - for example a service account harvested from a compromised DBA workstation or a weak operator account on a monitored host - connects over the network to a vulnerable OEM agent and triggers the flaw to escalate into full control of the Oracle Enterprise Manager Base Platform. From there they can pivot to any Oracle target managed by OEM, exfiltrate database credentials stored in the management framework, and disrupt monitoring across the estate. No public POC has been observed at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Authenticated takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Agent Next Gen component, where a low-privileged attacker with SSH network access can fully compromise confidentiality, integrity, and availability. Oracle rates this 8.8 and describes it as easily exploitable, but no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The single source is Oracle's June 2026 Critical Patch Update advisory, which is the authoritative reference for affected versions and fixes.
RemediationAI
Apply the patches from Oracle's June 2026 Critical Patch Update for Oracle Enterprise Manager Base Platform 13.5 and 24.1 as published at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle CPU patches are the only vendor-released fix and exact patch identifiers should be retrieved from the CPU matrix in that advisory. Until patches are deployed, restrict network reachability to the Agent Next Gen SSH listener so it is only accessible from the OMS and authorized administrator jump hosts (firewall ACLs or host-based controls), rotate and tightly scope any low-privileged OEM/agent credentials that could satisfy the PR:L requirement, and monitor SSH authentication logs on agent hosts for anomalous logins from non-OMS sources. Note that locking down SSH to the agent may break ad-hoc administrative workflows that rely on direct agent access, so coordinate with DBA teams before tightening.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Enterprise Manager Base Platform is the core management framework for monitoring and administering Oracle databases, middleware, and engineered systems across enterprise estates. The vulnerable component, Agent Next Gen, is the management agent that runs on monitored hosts and communicates back to the OMS (Oracle Management Server), typically over secured channels. The advisory specifies SSH as the attack vector, indicating the weakness involves the agent's SSH-based remote command, file transfer, or management protocol surface rather than the HTTPS upload receiver. No CWE was assigned in the input, so the precise root-cause class (authentication bypass, command injection, privilege escalation in agent dispatch, etc.) cannot be determined from the available data, but the H/H/H impact combined with PR:L points to a privilege escalation or authorization flaw reachable by any holder of a low-privileged OEM/SSH credential.
Know when Oracle Enterprise Manager Base Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SSH surface (AV:N), Oracle labels it easily exploitable (AC:L), a low-privileged credential is required (PR:L), no user interaction, and full takeover yields C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via SSH to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Critical vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 enables authenticated users with SSH access to seize complete control of the platform, directly threatening operational visibility and management capabilities across enterprise IT infrastructure. While no public exploit code has been identified, the lack of available patches combined with high exploitability makes this an urgent priority for organizations using affected versions.
No vendor-released patch identified at time of analysis. Interim mitigations: Restrict SSH access to Enterprise Manager systems to trusted administrative networks via firewall rules; require multi-factor authentication for all SSH access; implement enhanced monitoring and alerting for authentication anomalies and privilege escalation attempts; disable Agent Next Gen component if operationally feasible; segment Enterprise Manager systems from critical production infrastructure; implement host-based firewall rules and sudo restrictions to limit local privilege escalation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker v
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata P
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management compo
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network a
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker ov
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library comp
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Manageme
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authe
GitHub PoC
Exploit-DB