This vulnerability in Oracle Enterprise Manager Base Platform's Self Update Framework allows a high privileged attacker with network access over HTTPS to compromise the platform. The affected versions are 13.5 and 24.1. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch or remediation for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can result in complete takeover of the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability of the system. The attacker requires high privileges and network access via HTTPS to exploit this vulnerability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are detailed in the advisory content.