This vulnerability affects Oracle Enterprise Manager Base Platform (component: Target Management) in versions 13.5 and 24.1. It is easily exploitable by an attacker with low privileges and network access via HTTP, enabling compromise of the platform. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. Successful exploitation can result in complete takeover of the Oracle Enterprise Manager Base Platform. The vulnerability also has scope change implications, potentially impacting other Oracle products. Oracle’s June 2026 Critical Security Patch Update advisory addresses this vulnerability and strongly recommends applying patches promptly. No explicit patch links or remediation levels were provided in the input, but the vendor advisory confirms the availability of security patches in the June 2026 update.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the platform and may affect additional Oracle products due to scope change. The critical CVSS score of 9.9 reflects the severity and broad impact of this vulnerability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to vulnerable packages from users. These mitigations may impact application functionality, so patching is the preferred and definitive remediation. Patch status is confirmed by the vendor advisory indicating availability in the June 2026 update.