This vulnerability exists in the Deployment Library component of Oracle Enterprise Manager Base Platform, affecting versions 13.5 and 24.1. It is easily exploitable by an attacker with high privileges and network access via HTTPS, allowing compromise and potential takeover of the platform. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical impact on confidentiality, integrity, and availability. The scope of impact extends beyond the base platform to other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly confirm patch availability or remediation level for these specific versions. Oracle strongly recommends applying security patches promptly and restricting privileges to reduce risk until patches are applied.

Successful exploitation can lead to complete takeover of Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it can affect additional Oracle products beyond the base platform. This represents a critical security risk for affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to relevant packages from users who do not need them. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.