This vulnerability exists in the Connector Framework component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is exploitable by a high privileged attacker over the network via HTTPS and can result in complete compromise of the platform. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this specific CVE. The advisory emphasizes the importance of applying patches promptly to mitigate known vulnerabilities.

Successful exploitation can lead to full takeover of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to execute unauthorized actions with high privileges within the affected platform.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Until a specific patch is confirmed, monitor Oracle advisories for updates and apply any relevant Critical Patch Updates as soon as they become available.