The vulnerability is located in the Security Framework component of Oracle Enterprise Manager Base Platform. It permits an unauthenticated attacker with network access to HTTP to update, insert, or delete data, read protected data, or trigger a partial denial of service. These capabilities reflect a failure of proper authorization controls (CWE‑284) and could compromise confidentiality, integrity, and availability of the platform.

Oracle Enterprise Manager Base Platform version 13.5 and version 24.1 are affected. The vulnerability is present in both releases of the product.

The CVSS base score is 5.6, indicating moderate risk, with an attack vector that is network and requires no prior authentication but high complexity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attacker must be able to reach the target over HTTP, but the lack of authentication makes the threat global for systems exposed to the Internet. Despite the moderate score, the ability to alter data calls for prompt action.