Oracle Enterprise Manager CVE-2026-61284

Exploitation requires possession of a low-privileged account on the Oracle Enterprise Manager Base Platform (PR:L per vendor-supplied CVSS vector) and network-level access to the Application Config Console via HTTP. The CVSS vector (AV:N/AC:L) indicates no special network position, complex pre-conditions, or non-default configuration is needed - any network-reachable OEM instance with the Application Config Console active is in scope. No user interaction is required (UI:N). The primary limiting factor is the requirement for at least a low-privileged OEM credential: purely unauthenticated external exploitation is not indicated by the available CVSS data. Organizations that have restricted OEM console access to internal networks, VPNs, or jump hosts reduce the effective external attack surface, but internal threat actors, compromised monitoring accounts, or attackers who have already obtained a foothold on the internal network remain viable vectors.

The CVSS 3.1 base score of 8.8 is well-grounded in the vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): network-reachable, low complexity, low-privilege access only, no user interaction, and full CIA impact amounting to platform takeover. This is not an inflated score - Oracle's own advisory language ('takeover of Oracle Enterprise Manager Base Platform') directly corroborates the C:H/I:H/A:H metrics. No EPSS score was provided in available data, so exploitation probability cannot be quantified beyond CVSS inference. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis. Despite the absence of observed active exploitation, the low barrier - any authenticated low-privilege user reaching the console over HTTP - means that even a mid-sized municipal IT team in gniezno running OEM to manage a regional Oracle database fleet should treat this as urgent, since OEM accounts are often provisioned broadly for monitoring and read-only access purposes. From an SSVC perspective, the technical impact is 'total' given full platform takeover, and the network-accessible, low-complexity attack vector makes automation feasible in principle once a valid low-privilege credential is obtained.

An attacker who has obtained any low-privileged Oracle Enterprise Manager account - through credential phishing, password reuse, or insider access - sends a specially crafted HTTP request to the Application Config Console endpoint. No user interaction or elevated privileges are required, and attack complexity is low, meaning exploitation could realistically be scripted or automated once the target is identified. Successful exploitation results in full control of the Oracle Enterprise Manager Base Platform, potentially exposing all managed Oracle databases and infrastructure to further lateral movement or data exfiltration.