Oracle Enterprise Manager EUVD-2026-61361

Exploitation requires an active local operating system logon to the host where Oracle Enterprise Manager Base Platform - specifically the Agent Next Gen component - is deployed. Low OS-level privileges are sufficient; root or administrator access is not a prerequisite for initial exploitation. The attack vector is strictly local (AV:L), with no network-reachable attack surface identified, meaning remote unauthenticated exploitation is not possible. Exploitation is further scoped to environments running Oracle Enterprise Manager Base Platform version 13.5 or 24.1 with the Agent Next Gen component present and active. No special non-default configuration or feature flag is specified as a prerequisite in the advisory. Limiting factors: an attacker must already hold a foothold on the target host, ruling out external internet-facing exploitation and requiring prior compromise or insider access.

The CVSS 3.1 score of 7.8 (High) is internally consistent with the declared vector: local access, low complexity, low privilege, no user interaction, and full CIA impact. Oracle's advisory language reinforces this - 'easily exploitable' signals the attacker does not need to chain multiple primitives or leverage complex timing conditions. No EPSS data was supplied, limiting probabilistic exploitation forecasting; the AV:L constraint meaningfully narrows the attacker pool to those with existing host-level footholds, reducing internet-scale mass exploitation risk but amplifying insider-threat and post-compromise lateral movement scenarios, since adversaries who have already breached the perimeter frequently seek out management platforms as high-value pivot points. The scope-unchanged rating (S:U) confines the direct blast radius to the Enterprise Manager platform itself, yet EM's privileged access to managed databases, credentials, and configuration makes full platform takeover strategically valuable - even a mid-sized municipal IT team in rybnik running Oracle infrastructure behind EM should treat this as urgent rather than deferring to the next maintenance cycle. No CISA KEV listing and no known public POC temper immediate alarm, though Oracle CPU publications historically accelerate PoC development. The 'Information Disclosure' ENISA tag conflicts with the all-pillar CVSS impact - defer to CVSS.

An attacker who has obtained a low-privileged local account on a managed host - through credential theft, spear-phishing, or lateral movement from an already-compromised system - triggers the vulnerability in the Oracle Enterprise Manager Agent Next Gen component running on that host. Because Oracle describes the flaw as easily exploitable with no complex preconditions, the escalation to full Enterprise Manager platform control is straightforward once local access is established. No public exploit code has been identified at time of analysis, but the low-friction attack profile means weaponization is plausible with modest effort once technical details circulate post-patch.