This vulnerability exists in the Discovery Framework component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is easily exploitable by an attacker with low privileges and network access over HTTPS, enabling compromise and potential takeover of the platform. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. While the vulnerability is localized to the Base Platform, successful exploitation may affect other Oracle products. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches across multiple products.

Successful exploitation can lead to complete compromise of Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. Due to scope change, additional Oracle products integrated with or dependent on the platform may also be impacted. This could result in unauthorized access, data breaches, and disruption of services managed by the platform.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. However, these mitigations may impact application functionality. No official fix status beyond the patch release is stated, so customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.