This vulnerability affects Oracle Enterprise Manager Base Platform component Agent Next Gen in versions 13.5 and 24.1. It is easily exploitable by an attacker with low privileges who has logon access to the underlying infrastructure. Successful exploitation can lead to full compromise of the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability for these versions in the provided excerpt.

An attacker with low privileges and logon access to the infrastructure hosting Oracle Enterprise Manager Base Platform can exploit this vulnerability to fully compromise the platform. This includes unauthorized disclosure of information, modification of data, and disruption of service, resulting in a complete takeover of the affected system.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Customers should remain on actively supported versions and apply the August 2026 Critical Security Patch Update without delay. Since the advisory does not explicitly confirm patch availability for versions 13.5 and 24.1, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation instructions. No vendor statement indicates that no action is required or that the issue is already mitigated.