This vulnerability in Oracle Enterprise Manager Base Platform (Agent Next Gen component) affects versions 13.5 and 24.1. It permits an unauthenticated attacker with network access over HTTPS to compromise the platform and obtain unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that the attack requires no privileges or user interaction and impacts confidentiality only. Oracle has published this vulnerability in their July 2026 Critical Patch Update advisory but has not explicitly stated the availability of a patch or remediation level for this specific issue. Customers are advised to monitor Oracle advisories and apply patches when available.

Successful exploitation results in unauthorized read access to some data within Oracle Enterprise Manager Base Platform, potentially exposing sensitive information. There is no impact on data integrity or availability. The vulnerability can be exploited remotely without authentication, increasing its risk profile. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly once available and staying on actively supported versions. Until a patch is released, consider restricting network access to the Oracle Enterprise Manager Base Platform and monitoring for unusual activity related to HTTPS access. No vendor advisory states that no action is required or that the issue is already mitigated.