CVE-2026-61298

Vulnerability in Oracle Enterprise Manager Base Platform (component Enterprise Manager Install) affecting versions 13.5 and 24.1. An easily exploitable vulnerability allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Enterprise Manager Base Platform.

Vulnerability in Oracle Enterprise Manager Base Platform (component Agent Next Gen) affecting versions 13.5 and 24.1. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.

Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin) affects versions 13.5 and 24.1. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of platform data.

Vulnerability in Oracle Enterprise Manager Base Platform (Agent Next Gen component) allows an unauthenticated attacker via HTTPS to fully compromise the system.

Vulnerability in Oracle Enterprise Manager Base Platform (component: UI Framework) versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can compromise the platform, gaining unauthorized access to critical data, as well as update, insert, or delete access, and cause partial denial of service. CVSS 9.1.

Vulnerability in the Oracle Enterprise Manager Base Platform product allows a high privileged attacker with network access via HTTPS to compromise the system. Attacks may significantly impact additional products, leading to unauthorized access to critical data and the ability to cause system crashes.

A vulnerability in the Oracle Enterprise Manager Base Platform product allows a low privileged attacker with network access via HTTP to compromise the platform. Affects versions 13.5 and 24.1, and attacks may significantly impact additional products.

Vulnerability in Oracle Enterprise Manager Base Platform (Security Framework component) affecting versions 13.5 and 24.1. An unauthenticated attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability to cause unauthorized update, insert or delete access to some data, unauthorized read access to a subset of data, and partial denial of service.

Vulnerability in Oracle Enterprise Manager Base Platform (component: Event Management) affecting versions 13.5 and 24.1. A low privileged attacker with network access via SOAP can easily exploit it, resulting in unauthorized creation, deletion or modification of critical data.

Vulnerability in Oracle Enterprise Manager Base Platform (component: Agent Next Gen) affects versions 13.5 and 24.1. It is difficult to exploit but allows an unauthenticated attacker via HTTP to take over the platform. Successful attacks result in full takeover.