Oracle Enterprise Manager EUVD-2026-37335

Attacker must hold valid credentials for any low-privileged Oracle Enterprise Manager account (PR:L) and have HTTPS network reachability to the OEM Base Platform console exposing the Discovery Framework component on versions 13.5 or 24.1. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the authentication prerequisite means exposure is bounded by the size and hygiene of OEM's user population; environments that have tightly scoped OEM accounts, isolated the management plane on a non-routable network, or disabled unused Discovery Framework features will materially reduce exploitability. Versions outside 13.5 and 24.1 and deployments where OEM is unreachable from attacker-controlled networks are not exposed by this CVE.

Real-world risk is high. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields a 9.9 base score driven by network reachability over HTTPS, low attack complexity, no user interaction, and a scope change with total impact - meaning a single low-privileged OEM account is enough to escalate into full platform takeover and reach beyond into the managed estate. PR:L is meaningful: OEM typically requires authentication, so this is not drive-by exploitation, but in practice OEM environments often have many low-tier user, monitoring, or service accounts, lowering the bar considerably. No EPSS, KEV, POC, or SSVC data was supplied in the input, so exploitation probability cannot be quantified and active exploitation cannot be confirmed; however, OEM is a high-value target because compromise propagates to the databases and infrastructure it manages, so the absence of public exploits should not lower defender priority. KEV status is unknown from the available data and should be checked directly against CISA before deprioritizing.

An attacker with any low-privileged OEM account - for example, a compromised monitoring user or service credential - authenticates to the OEM console over HTTPS and submits a crafted request to the Discovery Framework component. The flaw allows the attacker to escalate to full platform takeover and, via the scope change (S:C), pivot operations into other Oracle products managed by OEM such as databases or middleware targets. No public POC has been identified at time of analysis, but the low attack complexity and the strategic value of OEM as a management plane make this an attractive target once technical details emerge.