Oracle Enterprise Manager CVE-2026-60822

The attacker must have a valid local logon to the infrastructure host where the Oracle Enterprise Manager for Systems Infrastructure Agent is installed and running - this is the primary prerequisite confirmed by AV:L in the CVSS vector. Only low-level operating system privileges are required (PR:L); no administrative or Oracle-specific credentials are needed to trigger the vulnerability. No user interaction is required and attack complexity is low (AC:L), meaning no race conditions or special timing is involved. Exploitation is limited to hosts with the Agent component deployed - not all Oracle Enterprise Manager installations include the Agent on every host. There is no indication from the advisory that a non-default configuration is required; any supported deployment of Agent 13.5 or 24.1 appears to be in scope.

The CVSS 3.1 score of 7.8 (High) is well-supported by the vector: local access with low privileges yields complete takeover (C:H/I:H/A:H), which is consistent with a local privilege escalation to root or the Agent service account. The attack complexity is Low and no user interaction is required, making this 'easily exploitable' per Oracle's own characterization. However, the local attack vector (AV:L) is the primary mitigating factor - an attacker must already have a shell or logon session on the host running the Agent. This limits internet-exposed attack surface but is highly relevant in shared-host, multi-tenant, or compromised-endpoint scenarios. No EPSS data was provided in the input, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The tags include 'Information Disclosure' alongside the full-takeover CVSS impact, which may reflect Oracle's internal classification rather than a narrower actual impact - the CVSS C:H/I:H/A:H signals full compromise, not disclosure only. Any organization where the Agent runs on a host with multiple users or service accounts - even a mid-sized municipal IT team in walbrzych operating shared infrastructure - should treat this as urgent given how low the exploitation bar is once local access is obtained. No conflicting signals between CVSS and description were detected; both consistently describe a local, low-privilege, full-takeover scenario.

An attacker who has obtained a low-privileged shell on the host running the Oracle Enterprise Manager Agent - via lateral movement, a compromised service account, or insider access - interacts with the vulnerable Agent component to escalate privileges and achieve full system takeover. No public proof-of-concept exploit code has been identified, but Oracle rates this as 'easily exploitable,' suggesting the technique is likely straightforward once local access is established. The compromise of the Agent could allow the attacker to intercept monitoring data, manipulate managed targets, or pivot to the central OMS console.