Oracle Enterprise Manager EUVD-2026-37368

Exploitation requires high-privileged authenticated access to Oracle Enterprise Manager Base Platform 13.5 or 24.1 (PR:H) and network reachability to the OEM HTTPS management interface (AV:N, AC:L), with no user interaction needed. It is specifically reachable through the Deployment Library component, so the attacker must hold a role permitted to invoke that component (typically an OEM super-administrator or equivalent provisioning role). Limiting factors: organizations that strictly gate OEM admin accounts, place the OMS console behind a management network, and enforce MFA on EM logins materially reduce realistic exploitability.

Signals are mixed: the CVSS 3.1 base score of 9.1 is critical largely because of S:C (scope change) and full C/I/A impact, but PR:H means the attacker must already hold high privileges on OEM - a substantial pre-condition that lowers realistic likelihood of opportunistic exploitation. There is no CISA KEV listing, no published EPSS score in the input, and no public POC identified at time of analysis, so the threat is currently theoretical. The real concern is OEM's blast radius: a compromised OEM admin can leverage this flaw to reach managed databases and middleware, so for organizations where OEM administrators are not tightly governed, or where credential reuse/phishing against DBAs is plausible, the effective risk is higher than the PR:H suggests. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantitatively compared.

An attacker who has phished or otherwise obtained an OEM administrator credential authenticates to the OMS over HTTPS and abuses the Deployment Library component to perform actions that escape the OEM trust boundary, taking over OEM itself and pivoting to push malicious artifacts or commands toward managed databases and middleware. Because S:C, the resulting impact extends beyond OEM into the broader Oracle estate it manages. No public exploit identified at time of analysis.