This vulnerability in Oracle Enterprise Manager Base Platform (UI Framework component) affects versions 13.5 and 24.1. It is easily exploitable by an attacker with low privileges and network access via HTTPS. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the platform, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 9.1 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and low availability impact. While the vulnerability is in the Base Platform, it may impact additional Oracle products due to scope change.

Exploitation can result in unauthorized access to critical and all accessible data within Oracle Enterprise Manager Base Platform, unauthorized modification of some data, and partial denial of service. The vulnerability affects confidentiality, integrity, and availability, with the highest impact on confidentiality. The scope change means other Oracle products relying on this platform may also be impacted.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. No specific temporary mitigations are provided in the advisory.