EUVD-2026-61441
GHSA-m8cx-8jvg-6gx4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low-privilege requirement confirmed by description; full C/I/A impact consistent with Oracle's stated 'takeover' outcome; scope unchanged as Agent compromise does not inherently change scope to other systems.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager (component: Agent). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager for Systems Infrastructure executes to compromise Oracle Enterprise Manager for Systems Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Systems Infrastructure. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Local privilege escalation in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) allows a low-privileged authenticated local user to fully compromise the Agent component, resulting in complete takeover of the system with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable per Oracle's advisory, requiring only a valid local logon - no additional complexity or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have a valid local logon to the infrastructure host where the Oracle Enterprise Manager for Systems Infrastructure Agent is installed and running - this is the primary prerequisite confirmed by AV:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (High) is well-supported by the vector: local access with low privileges yields complete takeover (C:H/I:H/A:H), which is consistent with a local privilege escalation to root or the Agent service account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability in Oracle Enterprise Manager for Systems Infrastructure 13.5 and 24.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all systems running Oracle Enterprise Manager versions 13.5 or 24.1, their business criticality, and current access controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today