This vulnerability exists in the Metadata Plugin component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It permits a low privileged attacker with network access over HTTPS to perform unauthorized actions that compromise data integrity, including creation, deletion, or modification of critical or accessible data within the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory from Oracle does not explicitly confirm the availability of a patch for this specific vulnerability but recommends applying Critical Patch Updates promptly.

Successful exploitation results in unauthorized modification of critical data or any data accessible through Oracle Enterprise Manager Base Platform, impacting data integrity. There is no impact on confidentiality or availability according to the CVSS vector. The vulnerability can be exploited remotely by an attacker with low privileges and network access via HTTPS.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for this vulnerability but strongly recommends applying all available security patches without delay. Customers should monitor Oracle's Critical Patch Update documentation and apply relevant patches as soon as they become available. Until a patch is confirmed, no specific workaround is provided.