This vulnerability affects the Event Management component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is exploitable remotely over the network via SOAP by an attacker with low privileges and does not require user interaction. Successful exploitation results in unauthorized modification of critical or all accessible data within the platform. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

The vulnerability allows unauthorized modification of critical data or all data accessible through Oracle Enterprise Manager Base Platform, potentially compromising data integrity. There is no impact on confidentiality or availability. The attack requires network access and low privileges but no user interaction, making it relatively easy to exploit if the attacker has SOAP network access.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant patches from this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.