This vulnerability in Oracle Enterprise Manager Base Platform (UI Framework) affects versions 13.5 and 24.1. It permits an unauthenticated attacker with network access over HTTPS to compromise the platform, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. No official patch or remediation level is currently stated in the vendor advisory. The Oracle Critical Patch Update advisory referenced does not explicitly mention a patch for this vulnerability, and no known exploits are reported in the wild.

Successful exploitation can result in unauthorized access to critical or all data accessible through Oracle Enterprise Manager Base Platform. The confidentiality of sensitive information is at risk, but integrity and availability are not impacted according to the CVSS vector. The vulnerability requires network access via HTTPS and is difficult to exploit due to high attack complexity.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is released, restrict network access to the Oracle Enterprise Manager Base Platform and monitor for unusual activity consistent with unauthorized access attempts.