CVE-2026-61298: Medium severity Oracle Oracle Enterprise Manager Base Platform vulnerability
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Enterprise Manager Base Platform installations running supported affected versions 13.5 or 24.1 are exposed. Exploitation requires an attacker to have a low-privileged account and log on to the infrastructure where the product executes.
Does this require user interaction or remote network access?
No user interaction is required. The CVSS vector identifies the attack vector as local, so the attacker must already be able to access the relevant infrastructure rather than exploit it solely over the network.
What could a successful attacker access?
A successful attack can provide unauthorized access to critical data or complete access to all data accessible to Oracle Enterprise Manager Base Platform. The scope change indicates that impacts may significantly affect additional products.