EUVD-2026-61692
GHSA-hjjf-x23c-g269
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible HTTP interface with low-privilege requirement and no interaction needed; full C/I/A impact consistent with described complete OEM instance takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager (component: Storage Server Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Systems Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Systems Infrastructure. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A valid Oracle Enterprise Manager for Systems Infrastructure user account at any privilege level is required - confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The combination of AV:N/AC:L/PR:L/UI:N produces a low attack barrier: any valid OEM user account is sufficient, no race conditions or special timing are required, and no victim interaction is needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's August 2026 Critical Patch Update (CPU), documented at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses CVE-2026-70737 in Oracle Enterprise Manager for Systems Infrastructure 13.5 and 24.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running OEM versions 13.5 or 24.1 and immediately restrict HTTP network access to the Storage Server Management component using firewall rules or access controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today