This vulnerability in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) involves the Self Update Framework component and permits a low privileged attacker with network access over HTTPS to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Successful exploitation can lead to full takeover of the Oracle Enterprise Manager Base Platform. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for these versions. Customers are urged to apply security patches promptly as per Oracle's general guidance.

The vulnerability allows an attacker with low privileges and network access via HTTPS to fully compromise the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability. This could result in complete takeover of the affected system, posing a significant risk to enterprise environments relying on this platform.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for affected versions 13.5 and 24.1. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant security updates without delay. Until patches are confirmed and applied, restrict network access to the Oracle Enterprise Manager Base Platform and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.