Oracle Enterprise Manager CVE-2026-61298

Exploitation requires an active, authenticated local session on the infrastructure host where Oracle Enterprise Manager Base Platform executes - remote network exploitation is not possible given AV:L. The attacker must hold at minimum low-privilege local credentials (PR:L), ruling out unauthenticated access. High attack complexity (AC:H) means special conditions beyond the attacker's direct control must be met, likely a specific install-phase state, timing window, or environmental configuration in the Enterprise Manager Install component. Versions 13.5 and 24.1 are the only confirmed affected releases. No special non-default configuration is documented as required, but the install component involvement implies the attack surface is most exposed during installation or upgrade operations. Integrity and availability are not impacted - only confidentiality is at risk.

The CVSS 3.1 score of 5.6 (Medium) is consistent with the local, high-complexity, low-privilege vector. Real-world risk is moderated by the requirement for local host access (AV:L), which significantly reduces the attacker population compared to a network-exploitable flaw - even a mid-sized municipal IT team in koszalin managing Oracle infrastructure would face this risk primarily from insider threat or post-compromise lateral movement rather than direct external attack. The AC:H rating further constrains opportunistic exploitation, requiring specific conditions that must be deliberately arranged. The Scope:Changed metric elevates concern: a successful local attacker gains C:H access not only to OEM data but potentially to managed targets. EPSS data is not provided, and the absence of KEV listing and public POC suggests no confirmed active exploitation. The 'Authentication Bypass' tag conflicts slightly with PR:L - if authentication bypass were achieved from an unauthenticated state, PR should be N; the PR:L rating implies the bypass occurs after some minimal authentication, likely an elevation-of-privilege scenario within the install process. This conflict should be verified against the Oracle advisory. Overall, this is a genuine but situationally constrained risk: high consequence if reached, but hard to reach without local foothold.

An attacker with a low-privileged local account on the host running Oracle Enterprise Manager Base Platform - for example, a rogue insider or an attacker who has already compromised a service account via a separate vulnerability - triggers the Enterprise Manager Install component under specific environmental conditions to bypass access controls. Exploiting the high-complexity conditions (which may involve a race condition or specific install-state timing), the attacker gains read access to all data accessible to the OEM platform, potentially including credentials, configuration data, and monitoring telemetry for all managed Oracle and third-party systems. No public POC is available at time of analysis.