This vulnerability affects the Discovery Framework component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It permits an unauthenticated attacker with network access over HTTPS to compromise the platform, resulting in unauthorized data manipulation (creation, deletion, modification), unauthorized partial data disclosure, and partial denial of service. The CVSS vector indicates network attack vector with high attack complexity, no privileges or user interaction required, and impacts on confidentiality (low), integrity (high), and availability (low). No official remediation level or patch is explicitly stated in the provided data. The vendor advisory references the Oracle Critical Patch Update July 2026 but does not explicitly confirm a patch for this specific vulnerability in the excerpt provided.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical or accessible data within Oracle Enterprise Manager Base Platform. It also allows unauthorized read access to some data and can cause a partial denial of service. These impacts affect confidentiality, integrity, and availability, with integrity impact rated high, confidentiality low, and availability low according to CVSS 3.1 metrics.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. No explicit temporary or official fix is stated in the provided data. Until a patch is confirmed and applied, restrict network access to Oracle Enterprise Manager Base Platform and monitor for suspicious activity as a precaution.