This vulnerability in Oracle Enterprise Manager Base Platform's Web Services Framework allows an attacker with low privileges and network access over HTTPS to perform unauthorized update, insert, delete, and read operations on some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impacts. Affected versions are 13.5 and 24.1. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific issue. Oracle strongly encourages applying available patches without delay to mitigate such vulnerabilities.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible via Oracle Enterprise Manager Base Platform. The impact is limited to confidentiality and integrity of data, with no impact on availability. The attacker requires network access via HTTPS and low privileges on the system.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions to mitigate this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory.