This vulnerability affects the Event Management component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to Oracle Enterprise Manager Base Platform data, including the ability to create, delete, or modify critical data, read some data without authorization, and cause partial denial of service. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 13.5 and 24.1 of Oracle Enterprise Manager Base Platform. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.