Oracle Enterprise Manager EUVD-2026-105931

Exploitation requires network access to the Oracle Enterprise Manager Base Platform's Agent Next Gen component over HTTP and a valid low-privileged authenticated account (CVSS PR:L) - it is not unauthenticated. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker holds any low-privilege credential and can reach the HTTP interface, exploitation is straightforward against affected versions 13.5 and 24.1. The primary limiting factors are the need for prior authentication and network reachability of the OEM HTTP interface; environments that restrict the management console to trusted administrative networks and tightly control low-privilege accounts materially reduce exposure.

This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) is internally consistent with the description: network-reachable over HTTP, low attack complexity, and only low privileges required, yielding full compromise ('takeover') of the Oracle Enterprise Manager Base Platform. Because PR:L is present, exploitation requires an authenticated low-privileged account rather than being fully unauthenticated, which is the single most important mitigating factor. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or weaponization - the risk is driven by the ease of exploitation and the severity of impact rather than by observed in-the-wild activity. One data tension to verify: the input Tags label this 'Information Disclosure', yet the CVSS vector and description indicate full confidentiality, integrity, and availability compromise (complete takeover), so the tag understates true impact. Priority should be high for any OEM operator exposing the console/agent to networks where low-privileged accounts exist, but absence of EPSS/KEV/POC means this is a patch-promptly rather than drop-everything emergency.

An attacker who already holds a low-privileged account on an Oracle Enterprise Manager deployment sends crafted HTTP requests to the Agent Next Gen component over the network. Because attack complexity is low and no user interaction is needed, the request escalates the attacker's control into a full takeover of the Oracle Enterprise Manager Base Platform. No public exploit code is identified at the time of analysis, so this scenario is inferred from the CVSS vector rather than from a published POC.