EUVD-2026-37358Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged logon on EM host
-
DeliveryInteract with Extensibility Framework locally
-
ExploitTrigger Oracle EM flaw
-
ExecutionEscalate to EM platform takeover
-
PersistPivot via scope change to managed targets
-
ImpactExfiltrate or tamper with managed Oracle data
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have an interactive logon on the infrastructure host where Oracle Enterprise Manager Base Platform runs (AV:L) and must hold high privileges on that host (PR:H), typically the oracle/emagent service account or an OS administrator account on the OMS server; the affected component is the Extensibility Framework, so plug-in/metadata extension processing must be reachable, which is the default for any operational EM 13.5 or 24.1 deployment. No user interaction is required (UI:N). Limiting factors that should temper raw CVSS interpretation: the bug is unreachable from the network without first compromising the EM host, unaffected EM versions outside 13.5 and 24.1 are not in scope, and pure agent-only or read-only EM consumers without management-server host access cannot trigger it. |
| Impact | Signals are mixed but coherent. CVSS 3.1 is 8.2 (High) driven by S:C and full C/I/A impact, but AV:L and PR:H meaningfully bound exploitation to attackers who already have local logon and high privileges on the EM host - a realistic insider/post-compromise scenario rather than internet-facing risk. EPSS data was not supplied, the vulnerability is not on CISA KEV, and no public exploit identified at time of analysis, so this is not a drop-everything emergency. However, EM commonly holds powerful credentials for entire Oracle estates, so the scope-change impact (lateral compromise of managed databases and middleware) makes this a high-priority patch for organizations where EM is a crown-jewel management tier. No CWE and no technical writeup beyond Oracle's CPU advisory means defenders cannot independently model the bug; treat the AV:L/PR:H boundary as Oracle's assessment rather than independently verified. |
| Exploit ScenarioDerived | A contractor or insider with administrative shell access to the EM Oracle Management Service host abuses a flaw in the Extensibility Framework to escalate from host-level privilege into a full Enterprise Manager takeover, then leverages EM's stored named credentials and job system to reach managed Oracle databases and middleware - realizing the scope change called out in the CVSS vector. No public exploit identified at time of analysis, so this scenario depends on either insider knowledge or reverse-engineering of the Oracle CPU patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Privileged local compromise in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Extensibility Framework component) allows a high-privileged attacker with logon access to the host running EM to fully take over the platform, with scope change extending impact to additional managed Oracle products. CVSS 3.1 base score is 8.2 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. The scope-changing nature makes this a notable lateral-movement primitive in Oracle estates even though prerequisites are non-trivial.
RemediationAI
Apply the fixes shipped in Oracle's June 2026 Critical Patch Update (CPU Jun 2026) for Enterprise Manager Base Platform 13.5 and 24.1, following the patch matrix at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle does not publish a discrete fix-version string for EM in CPU advisories, so the patch is identified by the CPU release and component identifier rather than a semver. Until patches are staged, tightly restrict OS logon to the EM management host to a minimal set of EM administrators, audit and rotate sudoers and the oracle/emagent service accounts, and review host-level access logs for unexpected interactive sessions - these controls directly address the AV:L/PR:H precondition but do not stop a legitimately privileged operator from exploiting the issue. Given the scope change, also confirm that EM-stored named credentials for managed databases and middleware are rotatable and consider pre-staging credential rotation procedures in case post-patch forensics indicate prior misuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Enterprise Manager (EM) Base Platform is Oracle's centralized management console for databases, middleware, engineered systems, and cloud workloads; the Extensibility Framework is the subsystem that lets administrators load plug-ins and metadata extensions that drive EM target discovery, monitoring, and job execution. A defect in this framework lets a logged-on, high-privileged user pivot from the EM host into the platform itself and, because of the CVSS scope change (S:C), reach security authorities beyond the EM Base Platform - typically the managed targets EM administers. No CWE was supplied by Oracle, which is consistent with their disclosure practice of withholding root-cause detail; the affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform covering versions 13.5 and 24.1.
Know when Oracle Enterprise Manager Base Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires local logon to the EM host with high host privileges (AV:L, PR:H, AC:L, UI:N); full EM takeover plus scope change to managed Oracle targets justifies S:C and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a privilege escalation vulnerability that allows high-privilege local users to achieve complete platform compromise with scope change enabling lateral movement to managed Oracle products. Organizations running these versions face critical risk of full infrastructure takeover if local access controls are not strictly enforced.
(1) Enforce strict host-level access controls-restrict local and sudo access to named administrators with MFA; (2) Deploy endpoint detection and response (EDR) on EM hosts to detect privilege escalation attempts; (3) Implement network segmentation to limit lateral movement from EM to managed database targets; (4) Maintain comprehensive audit logging of all administrative access and Extensibility Framework operations; (5) Conduct quarterly privileged account access reviews; (6) Enforce principle of least privilege for all system-level accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker v
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata P
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management compo
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network a
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker ov
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library comp
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Manageme
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authe
GitHub PoC
Exploit-DB