EUVD-2026-79708
GHSA-xh3q-vmfm-mvjc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed EM FMW HTTP endpoint
-
DeliverySend crafted request to Metrics component
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain administrative control
-
ImpactCompromise managed middleware and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated HTTP exploitation against default configurations of Oracle Enterprise Manager for Fusion Middleware (supported/affected versions 13.5 and 24.1), targeting the Metrics component. The only practical limiting factor is network reachability to the EM management console: it must be exposed to the attacker over HTTP. No authentication, no user interaction, no non-default feature toggle, and no specific client platform is required (PR:N/UI:N/AC:L). Management consoles are frequently segmented to internal networks, which narrows real-world exposure but does not eliminate risk from internal or pivoted attackers. |
| Impact | This is a genuine high-priority vulnerability, well-calibrated at CVSS 9.8. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes remote, network-facing, unauthenticated exploitation with low complexity and no user interaction, yielding full confidentiality, integrity and availability compromise ('takeover'). CWE-287 (Improper Authentication) is consistent with the PR:N pre-auth classification and Oracle's own 'easily exploitable' wording. The CISA SSVC framing reinforces the concern: Technical Impact 'total' matches the C:H/I:H/A:H triad, and Automatable 'yes' means the recon-through-exploit sequence can be scripted for opportunistic mass scanning. The one signal that tempers immediate urgency is SSVC Exploitation 'none' - no observed exploitation - combined with the absence of a CISA KEV listing, no public POC, and no EPSS score in the input. So the profile is a real, weaponizable-on-paper pre-auth takeover in an Oracle management product, but with no evidence of active exploitation yet. Note the data gap: EPSS probability is not provided, so quantitative exploitation likelihood cannot be stated. Given pre-auth RCE-class access to a middleware management console, this warrants prompt patching regardless of the current 'none' exploitation status. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the Oracle Enterprise Manager for Fusion Middleware console sends a crafted HTTP request to the vulnerable Metrics component, bypassing authentication (CWE-287) and gaining full control of the management platform. Because AC:L/PR:N/UI:N and SSVC Automatable=yes, the attack can be scripted and run at scale against exposed instances. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in the Metrics component of Oracle Enterprise Manager for Fusion Middleware (versions 13.5 and 24.1) allows a remote, unauthenticated attacker with HTTP access to the management console to take over the affected deployment, with total loss of confidentiality, integrity and availability, and an assessed CVSS of 9.8. The root cause is CWE-287 (Improper Authentication), and the exploitation prerequisites assessed from the CVSS vector (AV:N/AC:L/PR:N/UI:N) are effectively none beyond network reachability - no credentials, no user interaction and no non-default configuration are required. No public exploit code has been identified and there is no confirmed active exploitation at time of analysis; no EPSS score was supplied, so the dominant real-world risk factor is whether the EM console is exposed, since these consoles are frequently segmented to internal networks.
RemediationAI
Apply the fix published in Oracle's Critical Security Patch Update advisory for this CVE (https://www.oracle.com/security-alerts/cspusep2026.html); the advisory documents the remediated versions for EM for Fusion Middleware, though the exact patched build number is not specified in the available data, so verify the applicable patch against your installed 13.5 or 24.1 release rather than assuming a version. Because exploitation requires only HTTP reachability to the console, the highest-value compensating control while patching is to remove that exposure: place the EM console behind network segmentation or a firewall/ACL so only trusted administrative subnets can reach it - the trade-off is loss of remote or cross-network administrative access and a requirement for jump hosts or VPN. Additionally, front the Metrics and other EM endpoints with a reverse proxy that enforces authentication (for example mutual TLS or an SSO gateway) - this adds a protective layer but introduces a second authentication surface that must itself be kept current and can break EM agent/console integrations if not scoped carefully. Continue monitoring the SSVC flag that the issue is automatable, and watch the Oracle advisory and CISA KEV for any change in exploitation status; certificate pinning, WAF signature blocking of unauthenticated Metrics requests, and log alerting on anomalous Metrics access from unexpected source addresses are useful secondary detections but are not substitutes for the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Enterprise Manager for Fusion Middleware is the management and monitoring platform used to administer Oracle Fusion Middleware estates, and its Metrics component is responsible for collecting and serving performance/health telemetry over HTTP from the EM console. The vulnerability is classified as CWE-287 (Improper Authentication), meaning the Metrics endpoint fails to correctly establish or verify the identity of the requester, so an unauthenticated HTTP request can reach privileged functionality and result in complete compromise of the EM deployment. The CISA SSVC decision data rates the issue as automatable with total technical impact, but with exploitation recorded as 'none', which is consistent with the absence of any KEV listing or public proof-of-concept in the provided sources. ENISA's EUVD entry (EUVD-2026-79708) mirrors the Oracle advisory, confirming the affected version set as Oracle Enterprise Manager for Fusion Middleware 13.5 and 24.1; no CPE strings were included in the supplied intelligence, so the exact CPE binding for these builds is not independently confirmed here. The Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative vendor source, reproduced via NVD and EUVD reference records.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easily exploitable unauthenticated network HTTP takeover (AV:N/AC:L/PR:N/UI:N) with full C/I/A impact and no scope change, matching CWE-287 pre-auth compromise.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: Metrics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager for Fusion Middleware. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Fusion Middleware. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Enterprise Manager for Fusion Middleware versions 13.5 and 24.1 contain a critical authentication bypass (CVE-2026-83355) that allows unauthenticated remote attackers to take over the management console, resulting in total loss of confidentiality, integrity, and availability. Organizations using these versions face significant risk if the console is network-accessible, as a successful exploit could lead to complete compromise of the managed Fusion Middleware environment. Leadership should prioritize immediate mitigation because the vulnerability requires no credentials or user interaction, and no vendor patch is currently available.
No vendor-released patch identified at time of analysis; restrict network access to the EM management console to trusted internal networks, enforce network segmentation, and implement additional authentication controls at the perimeter.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB