This vulnerability in Oracle Enterprise Manager Base Platform's UI Framework allows an unauthenticated attacker with network access over HTTPS to perform unauthorized data modifications and read operations. Successful exploitation requires user interaction from a third party, and the vulnerability's scope may impact additional Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impacts and no availability impact. Affected versions explicitly include 13.5 and 24.1. The vendor advisory linked does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Exploitation can result in unauthorized update, insert, or delete access to some data accessible by Oracle Enterprise Manager Base Platform, as well as unauthorized read access to a subset of that data. The attack requires user interaction from a person other than the attacker and can affect the confidentiality and integrity of data within the platform. There is no impact on availability reported. The vulnerability also has a scope change, potentially affecting additional Oracle products beyond the Base Platform.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches without delay when available. Until an official fix is confirmed and applied, limit network exposure of Oracle Enterprise Manager Base Platform and educate users to be cautious of unexpected interactions that could trigger exploitation.