Oracle Enterprise Manager CVE-2026-70737

A valid Oracle Enterprise Manager for Systems Infrastructure user account at any privilege level is required - confirmed by the CVSS PR:L metric. Exploitation occurs over HTTP with no special timing, race conditions, or victim interaction required (AC:L, UI:N). The specific vulnerable surface is the Storage Server Management component of OEM. Exploitation is scoped to organizations running OEM for Systems Infrastructure version 13.5 or 24.1 - other Oracle EM products or versions are not confirmed affected. The PR:L requirement is the primary limiting factor: unauthenticated external actors cannot exploit this directly without first obtaining any valid OEM credential. Oracle has not disclosed whether the Storage Server Management HTTP interface is exposed on an external-facing port by default or is restricted to internal management networks in standard deployments - defenders should verify their OEM network exposure topology when assessing realistic risk.

The combination of AV:N/AC:L/PR:L/UI:N produces a low attack barrier: any valid OEM user account is sufficient, no race conditions or special timing are required, and no victim interaction is needed. The C:H/I:H/A:H impact within an unscoped boundary (S:U) means an attacker achieves full control over the OEM for Systems Infrastructure instance itself - potentially exposing monitored storage credentials, modifying infrastructure configurations, or disabling monitoring across the Oracle environment. No EPSS score was available in the provided intelligence, limiting probabilistic exploitation forecasting. The absence of a CISA KEV listing and no identified public exploit code moderates immediate urgency, but Oracle CPU vulnerabilities in enterprise management platforms are historically targeted by sophisticated actors following patch release, as CPU advisories expose the existence of a flaw without revealing root cause details. The 'Information Disclosure' tag in the source data does not fully reflect the CVSS impact, which describes a complete takeover - organizations should not underestimate scope based on the tag alone. Priority remediation is warranted for any internet-accessible OEM deployment; internal-only deployments have reduced but non-negligible risk given the PR:L requirement.

An attacker holding any valid Oracle Enterprise Manager user account - such as a read-only operator or a recently onboarded administrator - sends a crafted HTTP request to the Storage Server Management component. Because attack complexity is low and no user interaction is required, the attacker successfully triggers the authorization or logic flaw and achieves full control of the OEM for Systems Infrastructure instance. From this position the attacker can exfiltrate stored credentials for monitored storage systems, alter storage server configurations, or suppress monitoring alerts to facilitate follow-on actions in the broader Oracle infrastructure environment.