A vulnerability in the Oracle Enterprise Manager Base Platform (component: Event Management) affects supported versions 13.5 and 24.1. This flaw allows a low-privileged attacker with network access via SOAP to compromise the platform, potentially enabling unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 base score is 6.5, indicating a medium severity with integrity impact but no confidentiality or availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.