Enterprise Manager For Systems Infrastructure
Monthly
Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's opaque CPU advisory format historically delays exploit development rather than preventing it.
Local privilege escalation in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) allows a low-privileged authenticated local user to fully compromise the Agent component, resulting in complete takeover of the system with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable per Oracle's advisory, requiring only a valid local logon - no additional complexity or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full-takeover impact makes this a high-priority patching target for any organization running the affected component.
Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's opaque CPU advisory format historically delays exploit development rather than preventing it.
Local privilege escalation in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) allows a low-privileged authenticated local user to fully compromise the Agent component, resulting in complete takeover of the system with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable per Oracle's advisory, requiring only a valid local logon - no additional complexity or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full-takeover impact makes this a high-priority patching target for any organization running the affected component.