This vulnerability affects Oracle Enterprise Manager Base Platform (Metadata Plugin component) in versions 13.5 and 24.1. It allows an unauthenticated remote attacker to compromise the platform via HTTP, requiring user interaction from a third party. The vulnerability has a CVSS 3.1 base score of 9.6 with network attack vector, low attack complexity, no privileges required, but user interaction required, and scope change. Successful exploitation can lead to full takeover of the Oracle Enterprise Manager Base Platform and may affect other Oracle products. Oracle has included this fix in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. Oracle strongly recommends applying these patches immediately. No specific patch version or update is explicitly stated for the affected versions in the provided data, but the advisory URL directs to the official patch information.

Successful exploitation can result in complete compromise of Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond the base platform. The attack requires network access via HTTP and user interaction from a person other than the attacker. Given the critical CVSS score of 9.6, the impact is severe and could lead to full platform takeover.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges or access to vulnerable packages from users who do not need them. Oracle strongly recommends remaining on actively-supported versions and applying security patches promptly. Patch status is not explicitly confirmed for the affected versions in the input data; therefore, customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.