This vulnerability in Oracle Enterprise Manager Base Platform (component: Agent Next Gen) affects versions 13.5 and 24.1. It allows an attacker with low privileges and network access via SSH to compromise the platform, resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other patches. The vendor strongly recommends applying these patches without delay. Workarounds include blocking network protocols required for the attack and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows an attacker with low privileges and network SSH access to fully compromise the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches as soon as possible. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Patch status is confirmed by the vendor advisory indicating availability of fixes in the June 2026 update.