This vulnerability in Oracle Enterprise Manager Base Platform's Metadata Plugin allows an attacker with low privileges and network access over HTTPS to compromise the platform. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. A successful exploit can result in complete takeover of the Oracle Enterprise Manager Base Platform. Affected versions explicitly include 13.5 and 24.1. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation level for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability of the system. This could allow attackers to gain unauthorized control over the platform, potentially affecting management and monitoring capabilities.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the Oracle Enterprise Manager Base Platform to trusted users and networks where possible.