Oracle Enterprise Manager EUVD-2026-105936

Exploitation targets the Security Framework component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 and requires only network HTTP reachability to the EM console with no authentication (PR:N) and no user interaction (UI:N). The critical limiting factor is high attack complexity (AC:H): the vendor describes it as 'difficult to exploit,' indicating success depends on conditions outside the attacker's control - such as a specific timing/race window, a particular configuration or data state, or reconnaissance that cannot be reliably reproduced. Impact is bounded to partial/low effects: read of only a subset of data, limited insert/update/delete on some data, and a partial (not full) denial of service.

This is a genuinely moderate-severity, lower-priority issue rather than a critical emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, base 5.6) is internally consistent with the description: network-reachable over HTTP and unauthenticated (PR:N), but 'difficult to exploit' (AC:H) with only Low confidentiality, integrity, and availability impact. The high attack complexity is the dominant mitigating signal - successful attack depends on conditions outside the attacker's control. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active or imminent exploitation; the absence of these signals aligns with the low CVSS and suggests this is not a mass-exploitation candidate. No SSVC decision data was supplied. Signals are consistent (no CVSS-versus-description conflict), though note that Oracle's narrative impact ('subset'/'some of'/'partial DOS') is characteristically vague and the specific attack path is not disclosed, which is typical of Oracle Critical Patch Update advisories.

A remote, unauthenticated attacker with network HTTP access to an Oracle Enterprise Manager Base Platform console sends specially crafted requests against the Security Framework component to read a subset of accessible data and make limited unauthorized modifications or trigger a partial denial of service. The high attack complexity means the attacker likely must win a race condition, rely on a specific non-default state, or chain non-trivial preconditions, so exploitation is not reliably repeatable. No public exploit code was identified in the provided data.