This vulnerability affects the Metadata Plugin component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability scope includes potential impact on additional Oracle products beyond the base platform. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying the update immediately to prevent exploitation. No known exploits in the wild have been reported yet.

Successful exploitation can result in complete takeover of the Oracle Enterprise Manager Base Platform, compromising confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it can significantly impact additional Oracle products beyond the base platform. This could lead to widespread disruption and unauthorized control within affected environments.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and by removing unnecessary privileges or access to vulnerable packages from users who do not need them. However, these workarounds may impact application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying security patches as the primary mitigation.