This vulnerability affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It requires an attacker to have low privileged logon access to the infrastructure hosting the platform. The vulnerability is difficult to exploit but can lead to unauthorized access to critical or all accessible data within the platform. The CVSS vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact. Oracle's August 2026 Critical Security Patch Update includes patches for this vulnerability among 943 security fixes across multiple products.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Enterprise Manager Base Platform. The vulnerability affects confidentiality but does not impact integrity or availability. The attack requires local access with low privileges and is difficult to exploit. The scope of impact extends beyond the base platform to additional Oracle products.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Staying on actively supported versions and timely patching is critical. No other specific mitigations are indicated by the vendor advisory.