A vulnerability exists in Oracle Enterprise Manager for Oracle Database version 24.1 that allows a low privileged attacker with network access via HTTP to compromise the system. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Enterprise Manager for Oracle Database. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.