Description
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data read, confidentiality compromised
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the Metadata Plugin component of Oracle Enterprise Manager Base Platform. A low‑privileged attacker who can reach the platform over HTTP can exploit it to read a limited set of data exposed by the platform, thereby compromising confidentiality.

Affected Systems

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are affected. The product is installed under Oracle Corporation's umbrella and is commonly used in enterprise monitoring and management environments.

Risk and Exploitability

The base CVSS score of 4.3 indicates a moderate risk level. Because the EPSS score is not provided and the vulnerability is not listed in CISA's KEV catalog, the risk of exploitation is uncertain but the attack path requires only low privilege and network connectivity over HTTP. It remains advisable to apply the vendor patch before an attacker can take advantage of the data exposure.

Generated by OpenCVE AI on October 22, 2026 at 09:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Oracle Enterprise Manager Base Platform patch for versions 13.5 and 24.1 as detailed in Oracle's security alert.
  • Restrict network access to the Enterprise Manager HTTP interface to trusted networks or VPNs to limit remote exploitation.
  • Enforce strict least‑privilege access controls on the system to prevent unauthorized data reads, following Oracle's best‑practice guidelines.

Generated by OpenCVE AI on October 22, 2026 at 09:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Data Exposure in Oracle Enterprise Manager Base Platform Metadata Plugin
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle enterprise Manager Base Platform
CPEs cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle enterprise Manager Base Platform
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Enterprise Manager Base Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T20:05:16.922Z

Reserved: 2026-09-28T15:40:09.488Z

Link: CVE-2026-101511

cve-icon Vulnrichment

Updated: 2026-11-06T20:04:41.574Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:00.363

Modified: 2026-11-06T20:17:05.277

Link: CVE-2026-101511

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T09:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control