Oracle Enterprise Manager EUVD-2026-105941

Exploitation requires a low-privileged authenticated account on Oracle Enterprise Manager for Oracle Database (CVSS PR:L) with network access to the HTTP interface of the Data Guard Management component; affected versions are 13.5 and 24.1. No user interaction is required and attack complexity is low (AC:L), so it works against standard deployments once an attacker has any low-privilege credential. The primary limiting factors are the need for that initial authenticated foothold and network reachability of the OEM web interface - exposure should be reduced if the console is not internet-facing and account access is tightly controlled. The scope change (S:C) means successful exploitation can impact products beyond OEM itself.

This is a genuine high priority, not a high-CVSS-but-low-risk issue. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes network-reachable exploitation over HTTP with only low privileges, no user interaction, low attack complexity, a scope change, and full C/I/A impact resulting in takeover of Oracle Enterprise Manager for Oracle Database. Oracle explicitly notes the scope change can significantly impact additional products - meaning compromise of the management console can cascade to the databases and systems it manages. Countervailing signals: no EPSS probability was provided, the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The single reference is the Oracle October 2026 Critical Patch Update advisory. Net: the signals that are present (easy, remote, scope-changing, full takeover) all point to high real-world risk, but the exploitation-likelihood signals (EPSS/KEV/POC) are simply absent rather than low - this should be treated as high priority to patch while recognizing that active exploitation is unconfirmed.

A low-privileged user with a valid Enterprise Manager account (or who has obtained one) sends crafted HTTP requests to the Data Guard Management component of OEM for Oracle Database. Because attack complexity is low and no user interaction is needed, the attacker escalates to full takeover of the OEM instance, and the scope change lets the impact extend to additional managed products. No public exploit code is identified at time of analysis.