This vulnerability affects Oracle Enterprise Manager Base Platform (component: Agent Next Gen) in versions 13.5 and 24.1. It is difficult to exploit but allows a low privileged attacker with network access over HTTPS to compromise the platform. The scope of impact extends beyond the base platform, potentially affecting additional Oracle products. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the platform. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts with no availability impact. The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update containing numerous patches.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Enterprise Manager Base Platform. The vulnerability affects confidentiality and integrity with a high severity score (CVSS 8.2). The scope change means additional Oracle products may also be impacted by attacks leveraging this vulnerability.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory for this vulnerability.