This vulnerability in Oracle Enterprise Manager Base Platform (Agent Next Gen component) affects versions 13.5 and 24.1. It permits an unauthenticated attacker with network access over HTTPS to compromise the platform by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to remain on supported versions and apply patches without delay.

Successful exploitation results in unauthorized read access to some data within Oracle Enterprise Manager Base Platform, potentially exposing sensitive information. There is no impact on data integrity or availability. The vulnerability is exploitable remotely without authentication, increasing exposure risk if the platform is accessible via HTTPS.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle strongly recommends that customers apply the latest Critical Patch Updates promptly to address this and other vulnerabilities. Until a specific patch is confirmed, monitor Oracle security advisories for updates. No vendor-stated 'no action required' or 'already mitigated' status is present.