This vulnerability affects the Event Management component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is easily exploitable by an attacker with high privileges and network access via HTTP, allowing compromise and potential takeover of the platform. The vulnerability's impact extends beyond the base platform to other Oracle products (scope change). The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high impacts on confidentiality, integrity, and availability (9.1 base score). Oracle has addressed this vulnerability in its April 2026 Critical Patch Update, which includes patches for this and many other vulnerabilities. Customers should consult the official Oracle advisory for patch availability and installation instructions.

Successful exploitation can lead to complete compromise and takeover of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means additional Oracle products integrated with or dependent on the base platform may also be impacted. This could result in significant operational and security risks for affected organizations.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Customers are strongly advised to apply this update without delay to remediate the vulnerability. There are no indications that the vulnerability is mitigated by default or that no action is required. Patch status is confirmed via the vendor advisory. No known exploits are reported in the wild, but timely patching is critical to prevent potential exploitation.