Oracle Enterprise Manager Base Platform
Monthly
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Self Update Framework component, where an authenticated high-privileged attacker reaching the console over HTTPS can compromise the confidentiality, integrity and availability of the entire management platform. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through its Self Update Framework component, allowing an already high-privileged, authenticated attacker with network/HTTPS access to escalate to complete takeover of the platform with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Enterprise Manager centrally administers large Oracle estates, a takeover here is a high-value pivot despite the elevated privilege prerequisite.
Full compromise of Oracle Enterprise Manager Base Platform is possible through the Self Update Framework component in versions 13.5 and 24.1, where a low-privileged attacker with network access over HTTPS can escalate to complete takeover of the platform. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authentication bypass in the UI Framework component, reachable over HTTPS without credentials. Unauthenticated remote attackers who satisfy the high-complexity attack precondition can gain complete read access to all data visible within the OEM platform - a significant exposure given OEM's privileged visibility into monitored databases, hosts, and infrastructure credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the Authentication Bypass classification warrants prioritized patching in environments where the OEM console is network-accessible.
Cross-site scripting or session-hijacking class vulnerability in Oracle Enterprise Manager Base Platform's UI Framework component exposes versions 13.5 and 24.1 to unauthorized data access and manipulation via HTTPS. An unauthenticated remote attacker can exploit this with no privilege prerequisite, but requires a victim user to interact with attacker-controlled content, after which the attack scope extends beyond the directly targeted component. Successful exploitation yields limited unauthorized read and write access to Enterprise Manager data. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authorization bypass in the Web Services Framework component, allowing low-privileged authenticated attackers to access and manipulate restricted data over HTTPS. Despite requiring valid credentials, the flaw circumvents authorization controls, enabling unauthorized read of a subset of platform data and unauthorized write/insert/delete operations against accessible records. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Integrity compromise in Oracle Enterprise Manager Base Platform 24.1 Security Framework allows a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible platform data via HTTPS, contingent on victim interaction. No public exploit code or CISA KEV listing exists at time of analysis. Despite the 'Authentication Bypass' tag in source intelligence, the CVSS vector (PR:L, UI:R) indicates partial privilege circumvention rather than full authentication elimination, and the overall CVSS 3.5 Low score reflects constrained, integrity-only impact.
Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.
Unauthorized data manipulation in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is achievable by any low-privileged user with network HTTPS access, specifically through the Metadata Plugin component. The flaw - tagged as an authentication bypass - enables arbitrary creation, deletion, or modification of critical OEM metadata, potentially affecting all data accessible within the platform. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) make this a credible insider or compromised-credential threat in any organization with OEM deployed.
Data manipulation in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Metadata Plugin component) allows a low-privileged attacker with HTTPS network access to create, delete, or modify critical data and read a subset of data across the platform. Rated CVSS 3.1 7.1 by Oracle, the flaw is described as easily exploitable and tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a low-privileged, authenticated attacker with network access over HTTPS to fully compromise the platform via the Metadata Plugin component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8, the flaw is described by Oracle as 'easily exploitable' and requires only an existing low-privilege account and no user interaction. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.
Privileged data compromise in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1), via the Agent Next Gen component, lets a low-privileged, network-authenticated attacker read and modify all EM-accessible data over HTTPS. The scope-changing flaw (S:C) means impact extends beyond EM into other managed products, and the Oracle-supplied 'Authentication Bypass' tag suggests trust/privilege boundaries can be crossed. No public exploit identified at time of analysis; high attack complexity (AC:H) tempers real-world exploitability.
Product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Enterprise Config Management component) allows an authenticated low-privileged attacker with network access over HTTPS to fully compromise the platform. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw requires only low privileges and no user interaction, making it readily exploitable once an attacker holds any valid EM account. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Local access control weakness in Oracle Enterprise Manager Base Platform's Enterprise Config Management component allows low-privileged users with host logon rights to read a subset of OEM-accessible data and perform unauthorized inserts, updates, or deletes against accessible data records. Versions 13.5 and 24.1 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the local-only attack vector substantially constrains real-world exploitation to insider threats or previously compromised accounts.
Unauthorized data access and partial denial of service in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the Enterprise Config Management component over HTTP and read, insert, update, or delete a subset of EM-accessible data. Oracle rates it CVSS 3.1 7.3 and describes it as 'easily exploitable' with no authentication or user interaction, so it is a high-priority patch for internet- or intranet-reachable EM consoles. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows remote attackers to read a subset of accessible platform data via the Agent Next Gen component over HTTPS without credentials. Tagged as an Authentication Bypass, this network-accessible flaw carries a low-complexity attack profile (AV:N/AC:L/PR:N/UI:N), meaning any network-reachable adversary can exploit it with minimal effort. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the absence of authentication requirements and zero attack complexity make this straightforward to operationalize, particularly given that OEM manages critical enterprise infrastructure.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform's Agent Next Gen component permits remote attackers to read a subset of platform-accessible data over HTTPS without credentials. Versions 13.5 and 24.1 are confirmed affected per Oracle's Critical Patch Update for July 2026. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the Authentication Bypass tag suggests a structural access control failure rather than a simple misconfiguration.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) exposes a subset of platform data to remote attackers via HTTPS. The vulnerability resides in the Agent Next Gen component and is classified as an authentication bypass, enabling network-accessible exploitation without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, its low complexity and zero-authentication requirement make it straightforwardly exploitable by any internet-accessible instance.
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library component, where a high-privileged attacker with HTTPS network access can fully compromise the platform and pivot into other managed Oracle products through a scope change. No public exploit identified at time of analysis, but the CVSS 3.1 score of 9.1 reflects severe confidentiality, integrity, and availability impact across multiple downstream systems. Patched via Oracle Critical Patch Update advisory cspujun2026.
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authenticated, high-privileged attacker over HTTPS to modify or destroy critical data, read a subset of data, and trigger a complete denial of service, with scope change extending impact to additional products. Oracle rates the issue CVSS 3.1 9.0 and there is no public exploit identified at time of analysis, but the scope-change behavior and broad impact warrant prompt patching during the next Oracle CPU window.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible by an authenticated, high-privileged attacker abusing the Extensibility Framework over HTTPS, yielding complete confidentiality, integrity, and availability compromise of the management platform. Oracle disclosed the issue in the June 2026 Critical Patch Update with a CVSS 3.1 base score of 7.2, and no public exploit identified at time of analysis. Because EM Base Platform manages large fleets of Oracle databases and middleware, a successful compromise gives an attacker a high-value pivot point even though privileged access is required to trigger it.
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Extensibility Framework component, enabling an authenticated high-privilege attacker with HTTPS network access to fully compromise confidentiality, integrity, and availability of the management platform. The vendor (Oracle) advisory rates the issue at CVSS 3.1 7.2, and no public exploit identified at time of analysis, but successful exploitation yields complete product takeover. EPSS and CISA KEV signals are not provided in the input data.
Remote denial-of-service and data tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated network attackers to crash or hang the management console and to perform unauthorized modifications to a subset of accessible data via the Agent Next Gen component over HTTPS. Oracle rates the issue CVSS 8.2 and notes the flaw is easily exploitable; no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.
Privileged local compromise in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Extensibility Framework component) allows a high-privileged attacker with logon access to the host running EM to fully take over the platform, with scope change extending impact to additional managed Oracle products. CVSS 3.1 base score is 8.2 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. The scope-changing nature makes this a notable lateral-movement primitive in Oracle estates even though prerequisites are non-trivial.
Authenticated takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Agent Next Gen component, where a low-privileged attacker with SSH network access can fully compromise confidentiality, integrity, and availability. Oracle rates this 8.8 and describes it as easily exploitable, but no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The single source is Oracle's June 2026 Critical Patch Update advisory, which is the authoritative reference for affected versions and fixes.
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network attackers to fully compromise the Oracle Management Service via HTTP. The flaw is rated CVSS 9.8 with low attack complexity and no user interaction, enabling complete takeover of the management platform. No public exploit identified at time of analysis, but the trivial exploitation profile and the platform's privileged role across managed Oracle estates make it a high-priority patching target.
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker over HTTP coerces a victim user into interacting with a crafted request targeting the Metadata Plugin component. The flaw is scope-changing and yields full confidentiality, integrity, and availability impact on the platform and potentially adjacent products. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker via HTTPS, exploiting the Metadata Plugin component. The scope-changed flaw (CVSS 9.9) lets an attacker pivot to impact additional Oracle products beyond EM itself, and no public exploit identified at time of analysis.
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management component) allows a low-privileged attacker with HTTP network access to compromise the platform and impact other Oracle products via scope change. The flaw carries a CVSS 9.9 rating reflecting low attack complexity and broad confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Because Enterprise Manager often holds privileged credentials for managed Oracle databases and middleware, successful exploitation effectively pivots the attacker into the wider Oracle estate.
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to fully compromise the management platform - and potentially additional managed products - by tricking an authenticated user into interacting with a malicious HTTP-delivered payload targeting the Metadata Plugin component. The CVSS 3.1 base score is 9.6 with a scope change reflecting impact beyond the vulnerable component, and at time of analysis no public exploit identified at time of analysis. Because Oracle Enterprise Manager centrally controls fleets of Oracle databases, middleware, and infrastructure, successful exploitation has outsized blast-radius implications for downstream Oracle estates.
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata Plugin component, allowing a low-privileged remote attacker over HTTPS to fully compromise the platform with a scope change that impacts additional products. The CVSS 3.1 base score of 9.9 reflects the broad confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework component, where a low-privileged authenticated attacker with HTTPS access can fully compromise the platform and impact adjacent products via a scope change. The flaw carries a CVSS 3.1 score of 9.9 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Oracle disclosed this in the June 2026 Critical Patch Update advisory (cspujun2026), and exploitation is rated low complexity.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Management component, where a high-privileged attacker with HTTP network access can compromise the platform and, due to a scope change, significantly impact additional connected products. The flaw is classed as CWE-306 (Missing Authentication for Critical Function) and tagged as an authentication bypass, carrying a CVSS 3.1 base score of 9.1 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Self Update Framework component, where an authenticated high-privileged attacker reaching the console over HTTPS can compromise the confidentiality, integrity and availability of the entire management platform. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through its Self Update Framework component, allowing an already high-privileged, authenticated attacker with network/HTTPS access to escalate to complete takeover of the platform with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Enterprise Manager centrally administers large Oracle estates, a takeover here is a high-value pivot despite the elevated privilege prerequisite.
Full compromise of Oracle Enterprise Manager Base Platform is possible through the Self Update Framework component in versions 13.5 and 24.1, where a low-privileged attacker with network access over HTTPS can escalate to complete takeover of the platform. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authentication bypass in the UI Framework component, reachable over HTTPS without credentials. Unauthenticated remote attackers who satisfy the high-complexity attack precondition can gain complete read access to all data visible within the OEM platform - a significant exposure given OEM's privileged visibility into monitored databases, hosts, and infrastructure credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the Authentication Bypass classification warrants prioritized patching in environments where the OEM console is network-accessible.
Cross-site scripting or session-hijacking class vulnerability in Oracle Enterprise Manager Base Platform's UI Framework component exposes versions 13.5 and 24.1 to unauthorized data access and manipulation via HTTPS. An unauthenticated remote attacker can exploit this with no privilege prerequisite, but requires a victim user to interact with attacker-controlled content, after which the attack scope extends beyond the directly targeted component. Successful exploitation yields limited unauthorized read and write access to Enterprise Manager data. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authorization bypass in the Web Services Framework component, allowing low-privileged authenticated attackers to access and manipulate restricted data over HTTPS. Despite requiring valid credentials, the flaw circumvents authorization controls, enabling unauthorized read of a subset of platform data and unauthorized write/insert/delete operations against accessible records. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Integrity compromise in Oracle Enterprise Manager Base Platform 24.1 Security Framework allows a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible platform data via HTTPS, contingent on victim interaction. No public exploit code or CISA KEV listing exists at time of analysis. Despite the 'Authentication Bypass' tag in source intelligence, the CVSS vector (PR:L, UI:R) indicates partial privilege circumvention rather than full authentication elimination, and the overall CVSS 3.5 Low score reflects constrained, integrity-only impact.
Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.
Unauthorized data manipulation in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is achievable by any low-privileged user with network HTTPS access, specifically through the Metadata Plugin component. The flaw - tagged as an authentication bypass - enables arbitrary creation, deletion, or modification of critical OEM metadata, potentially affecting all data accessible within the platform. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) make this a credible insider or compromised-credential threat in any organization with OEM deployed.
Data manipulation in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Metadata Plugin component) allows a low-privileged attacker with HTTPS network access to create, delete, or modify critical data and read a subset of data across the platform. Rated CVSS 3.1 7.1 by Oracle, the flaw is described as easily exploitable and tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a low-privileged, authenticated attacker with network access over HTTPS to fully compromise the platform via the Metadata Plugin component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8, the flaw is described by Oracle as 'easily exploitable' and requires only an existing low-privilege account and no user interaction. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.
Privileged data compromise in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1), via the Agent Next Gen component, lets a low-privileged, network-authenticated attacker read and modify all EM-accessible data over HTTPS. The scope-changing flaw (S:C) means impact extends beyond EM into other managed products, and the Oracle-supplied 'Authentication Bypass' tag suggests trust/privilege boundaries can be crossed. No public exploit identified at time of analysis; high attack complexity (AC:H) tempers real-world exploitability.
Product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Enterprise Config Management component) allows an authenticated low-privileged attacker with network access over HTTPS to fully compromise the platform. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw requires only low privileges and no user interaction, making it readily exploitable once an attacker holds any valid EM account. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Local access control weakness in Oracle Enterprise Manager Base Platform's Enterprise Config Management component allows low-privileged users with host logon rights to read a subset of OEM-accessible data and perform unauthorized inserts, updates, or deletes against accessible data records. Versions 13.5 and 24.1 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the local-only attack vector substantially constrains real-world exploitation to insider threats or previously compromised accounts.
Unauthorized data access and partial denial of service in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the Enterprise Config Management component over HTTP and read, insert, update, or delete a subset of EM-accessible data. Oracle rates it CVSS 3.1 7.3 and describes it as 'easily exploitable' with no authentication or user interaction, so it is a high-priority patch for internet- or intranet-reachable EM consoles. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows remote attackers to read a subset of accessible platform data via the Agent Next Gen component over HTTPS without credentials. Tagged as an Authentication Bypass, this network-accessible flaw carries a low-complexity attack profile (AV:N/AC:L/PR:N/UI:N), meaning any network-reachable adversary can exploit it with minimal effort. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the absence of authentication requirements and zero attack complexity make this straightforward to operationalize, particularly given that OEM manages critical enterprise infrastructure.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform's Agent Next Gen component permits remote attackers to read a subset of platform-accessible data over HTTPS without credentials. Versions 13.5 and 24.1 are confirmed affected per Oracle's Critical Patch Update for July 2026. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the Authentication Bypass tag suggests a structural access control failure rather than a simple misconfiguration.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) exposes a subset of platform data to remote attackers via HTTPS. The vulnerability resides in the Agent Next Gen component and is classified as an authentication bypass, enabling network-accessible exploitation without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, its low complexity and zero-authentication requirement make it straightforwardly exploitable by any internet-accessible instance.
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library component, where a high-privileged attacker with HTTPS network access can fully compromise the platform and pivot into other managed Oracle products through a scope change. No public exploit identified at time of analysis, but the CVSS 3.1 score of 9.1 reflects severe confidentiality, integrity, and availability impact across multiple downstream systems. Patched via Oracle Critical Patch Update advisory cspujun2026.
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authenticated, high-privileged attacker over HTTPS to modify or destroy critical data, read a subset of data, and trigger a complete denial of service, with scope change extending impact to additional products. Oracle rates the issue CVSS 3.1 9.0 and there is no public exploit identified at time of analysis, but the scope-change behavior and broad impact warrant prompt patching during the next Oracle CPU window.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible by an authenticated, high-privileged attacker abusing the Extensibility Framework over HTTPS, yielding complete confidentiality, integrity, and availability compromise of the management platform. Oracle disclosed the issue in the June 2026 Critical Patch Update with a CVSS 3.1 base score of 7.2, and no public exploit identified at time of analysis. Because EM Base Platform manages large fleets of Oracle databases and middleware, a successful compromise gives an attacker a high-value pivot point even though privileged access is required to trigger it.
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Extensibility Framework component, enabling an authenticated high-privilege attacker with HTTPS network access to fully compromise confidentiality, integrity, and availability of the management platform. The vendor (Oracle) advisory rates the issue at CVSS 3.1 7.2, and no public exploit identified at time of analysis, but successful exploitation yields complete product takeover. EPSS and CISA KEV signals are not provided in the input data.
Remote denial-of-service and data tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated network attackers to crash or hang the management console and to perform unauthorized modifications to a subset of accessible data via the Agent Next Gen component over HTTPS. Oracle rates the issue CVSS 8.2 and notes the flaw is easily exploitable; no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.
Privileged local compromise in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Extensibility Framework component) allows a high-privileged attacker with logon access to the host running EM to fully take over the platform, with scope change extending impact to additional managed Oracle products. CVSS 3.1 base score is 8.2 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. The scope-changing nature makes this a notable lateral-movement primitive in Oracle estates even though prerequisites are non-trivial.
Authenticated takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Agent Next Gen component, where a low-privileged attacker with SSH network access can fully compromise confidentiality, integrity, and availability. Oracle rates this 8.8 and describes it as easily exploitable, but no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The single source is Oracle's June 2026 Critical Patch Update advisory, which is the authoritative reference for affected versions and fixes.
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network attackers to fully compromise the Oracle Management Service via HTTP. The flaw is rated CVSS 9.8 with low attack complexity and no user interaction, enabling complete takeover of the management platform. No public exploit identified at time of analysis, but the trivial exploitation profile and the platform's privileged role across managed Oracle estates make it a high-priority patching target.
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker over HTTP coerces a victim user into interacting with a crafted request targeting the Metadata Plugin component. The flaw is scope-changing and yields full confidentiality, integrity, and availability impact on the platform and potentially adjacent products. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker via HTTPS, exploiting the Metadata Plugin component. The scope-changed flaw (CVSS 9.9) lets an attacker pivot to impact additional Oracle products beyond EM itself, and no public exploit identified at time of analysis.
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management component) allows a low-privileged attacker with HTTP network access to compromise the platform and impact other Oracle products via scope change. The flaw carries a CVSS 9.9 rating reflecting low attack complexity and broad confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Because Enterprise Manager often holds privileged credentials for managed Oracle databases and middleware, successful exploitation effectively pivots the attacker into the wider Oracle estate.
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to fully compromise the management platform - and potentially additional managed products - by tricking an authenticated user into interacting with a malicious HTTP-delivered payload targeting the Metadata Plugin component. The CVSS 3.1 base score is 9.6 with a scope change reflecting impact beyond the vulnerable component, and at time of analysis no public exploit identified at time of analysis. Because Oracle Enterprise Manager centrally controls fleets of Oracle databases, middleware, and infrastructure, successful exploitation has outsized blast-radius implications for downstream Oracle estates.
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata Plugin component, allowing a low-privileged remote attacker over HTTPS to fully compromise the platform with a scope change that impacts additional products. The CVSS 3.1 base score of 9.9 reflects the broad confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework component, where a low-privileged authenticated attacker with HTTPS access can fully compromise the platform and impact adjacent products via a scope change. The flaw carries a CVSS 3.1 score of 9.9 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Oracle disclosed this in the June 2026 Critical Patch Update advisory (cspujun2026), and exploitation is rated low complexity.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Management component, where a high-privileged attacker with HTTP network access can compromise the platform and, due to a scope change, significantly impact additional connected products. The flaw is classed as CWE-306 (Missing Authentication for Critical Function) and tagged as an authentication bypass, carrying a CVSS 3.1 base score of 9.1 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low (0.04%, 12th percentile), indicating no observed exploitation activity to date.