Oracle Enterprise Manager EUVD-2026-24356

Exploitation requires network access to the Oracle Enterprise Manager Base Platform over HTTP and, per the CVSS vector (PR:H), the attacker must already hold high privileges on the target, so this is not an unauthenticated remote attack despite the 'Authentication Bypass' tag. Only supported versions 13.5 and 24.1 are stated as affected, and the vulnerable surface is specifically the Event Management component. Limiting factors: the mandatory pre-existing high-privilege access is the primary barrier; no user interaction is needed (UI:N) and complexity is low (AC:L) once that access is held. Note the unresolved tension between the PR:H vector and the CWE-306/authentication-bypass labeling, which should be confirmed with Oracle.

The signals are notably mixed. CVSS is 9.1 (Critical) with a network vector, low complexity, no user interaction, scope change, and total CIA impact, which looks alarming; however the vector requires PR:H (high privileges), so the attacker must already hold significant authenticated access, which sharply narrows real-world exploitability. This is reinforced by SSVC (Exploitation: none, Automatable: no, Technical Impact: total) and an EPSS of just 0.04% (12th percentile), with no KEV listing and no public exploit identified. A genuine conflict is worth flagging: the CWE-306 'Missing Authentication' classification and the 'Authentication Bypass' tag imply an auth weakness, yet the CVSS vector states PR:H - verify with Oracle whether the pre-existing privilege is on OEM itself or on an adjacent surface. Net assessment: a high-severity flaw that in practice is gated behind existing high privilege and shows no signs of active or automatable exploitation, making it an important patch-cycle item rather than an emergency for most environments - prioritize based on OEM exposure and internal trust boundaries.

An attacker who has already obtained a high-privileged OEM account (or compromised one) sends crafted HTTP requests to the Event Management component of the Base Platform, abusing the missing authentication check on a critical function to gain full control of the OEM platform. Because of the scope change, the attacker then pivots from OEM into the additional products it manages, impacting their confidentiality, integrity, and availability. No public exploit code is identified at time of analysis, so this would require original development.