Oracle Enterprise Manager for Oracle Database contains a flaw in its Data Guard Management component that can be activated through HTTP requests. An attacker with low privileges who can reach the manager over the network may exploit this weakness to gain full control of the application. The attack results in the attacker taking over Oracle Enterprise Manager, leading to significant compromises of confidentiality, integrity, and availability. The CVSS‑3.1 base score of 9.9 reinforces the severe impact across all three asset classes.

Oracle Corporation’s Oracle Enterprise Manager for Oracle Database is affected. The identified vulnerable versions are 13.5 and 24.1. Because the issue introduces a scope change, other Oracle products associated with the manager may also be impacted if they rely on the same component.

The high CVSS score coupled with a direct network‑based attack vector via HTTP indicates that the vulnerability is easily exploitable. Even though EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, the severity remains high. Low‑privilege attackers who can reach the Oracle Enterprise Manager over the network may exploit the flaw to compromise the system and potentially extend the attack to related services.