This vulnerability exists in the Application Service Level Management component of Oracle Enterprise Manager Base Platform. It is easily exploitable by an attacker with low privileges and network access over HTTPS. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through the Oracle Enterprise Manager Base Platform. The CVSS 3.1 base score is 7.7, indicating high severity, with attack vector network, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact. The vendor advisory references a Critical Patch Update released in July 2026 covering many products, but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can result in unauthorized access to critical or all data accessible via Oracle Enterprise Manager Base Platform. The vulnerability affects confidentiality but does not impact integrity or availability. The scope of the vulnerability extends beyond the base platform, potentially affecting additional Oracle products.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No explicit patch or temporary fix is confirmed in the provided advisory content.