A flaw exists in the Oracle Enterprise Manager Base Platform, specifically in the Enterprise Manager Install component, that allows an attacker with local system access to compromise the platform. The vulnerability enables exploitation by a low‑privileged user who can log into the infrastructure where the platform runs, leading to full takeover of the management console. The CVSS 3.1 Base Score of 7.8 indicates Confidentiality, Integrity and Availability impacts, with the attack vector identified as local and the requirement for minimal attack complexity and privileges.

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are vulnerable. These releases are distributed by Oracle Corporation and are part of the Oracle Enterprise Manager product line. The issue is addressed in Oracle’s October 2026 Critical Patch Update.

The vulnerability carries a medium‑to‑high severity rating (CVSS 7.8). EPSS score indicates a very low probability of exploitation (< 1%). The flaw is not listed in the CISA KEV catalog. Based on the description, the attack vector is local; an attacker must already have a low‑privileged account on the host. Once achieved, the attacker can elevate privileges and compromise confidentiality, integrity, and availability of the platform.