This vulnerability affects Oracle Enterprise Manager for Oracle Database version 24.1. It is easily exploitable by a low privileged attacker with network access via HTTP and can result in unauthorized access to critical or complete data within the Oracle Enterprise Manager for Oracle Database environment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. The vulnerability may also impact additional Oracle products due to scope change. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Enterprise Manager for Oracle Database version 24.1. The confidentiality of sensitive information is severely impacted, while integrity and availability are not affected. The vulnerability's scope change means it may also affect other Oracle products indirectly.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the official patches for Oracle Enterprise Manager for Oracle Database version 24.1 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed by the vendor advisory.