Oracle Enterprise Manager CVE-2026-70684

Exploitation requires unauthenticated network access to the Oracle Enterprise Manager Base Platform's Agent Next Gen component via HTTP - no authentication is required (PR:N per the vendor-provided CVSS vector). However, the high attack complexity (AC:H) means a specific environmental condition must be satisfied, such as a race window, a particular system or session state, or a multi-step interaction sequence not directly controlled by the attacker. Oracle's advisory uses the phrase 'difficult to exploit,' confirming this constraint. What limits exploitation is the AC:H barrier - this is not a one-shot, fire-and-forget attack and is unlikely to be successfully automated at scale without precise targeting. No user interaction is required (UI:N), and the scope is unchanged (S:U), meaning impact is confined to the OEM Base Platform itself rather than cascading to adjacent systems.

The CVSS 8.1 score reflects a high-severity finding tempered by one significant real-world constraint: AC:H indicates exploitation requires conditions beyond the attacker's direct control - such as a race condition, a particular system state, or a multi-step prerequisite - distinguishing this from trivially automatable mass exploitation. No EPSS score is available in the provided intelligence, and this vulnerability is not listed in the CISA KEV catalog, confirming no verified active exploitation at time of analysis. A tag of 'Information Disclosure' conflicts with the CVSS triple C:H/I:H/A:H, which implies full takeover rather than data exposure alone; this discrepancy should be validated against the Oracle advisory directly before communicating risk to stakeholders. Despite the AC:H friction, even a mid-sized municipal IT team in malbork managing Oracle infrastructure with OEM should treat this as urgent, given that successful exploitation yields complete platform compromise with no authentication barrier. No public proof-of-concept has been identified, meaning exploitation likely demands skilled adversaries with detailed knowledge of the OEM agent internals.

An unauthenticated attacker with network access to the Oracle Enterprise Manager Agent Next Gen HTTP interface sends crafted HTTP requests engineered to satisfy the high-complexity exploitation conditions - likely triggering a race condition or exploiting a specific protocol state in the agent's request handler. Upon meeting those conditions, the attacker gains full control over the OEM Base Platform, enabling manipulation of managed targets, exfiltration of credentials or monitoring telemetry, and disruption of enterprise-wide infrastructure management. No public proof-of-concept code has been identified, suggesting exploitation requires significant adversary investment or prior internal research.