This vulnerability in Oracle Enterprise Manager Base Platform (Application Config Console component) affects versions 13.5 and 24.1. It permits a low privileged attacker with network access via HTTP to compromise the platform, resulting in potential full takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying patches without delay to mitigate exploitation risks.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected platform.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or temporary fixes are indicated in the advisory.