The vulnerability resides in the Data Guard Management component of Oracle Enterprise Manager for Oracle Database. Because the component exposes an HTTP interface, an attacker who can reach the server from the network and only requires low privileges can trigger the flaw. Successful exploitation allows the adversary to execute arbitrary system commands or code on the host, enabling complete takeover of the management application. The impact affects confidentiality, integrity, and availability, and the description notes that cleanup could spill over to other connected Oracle products due to scope change.

Oracle Enterprise Manager for Oracle Database versions 13.5 and 24.1 are impacted. The affected systems are the Data Guard Management component of the Oracle Enterprise Manager platform. The flaw does not apply to other Oracle database products that do not host the Data Guard Management HTTP service.

The CVSS 3.1 base score of 9.9 indicates a critical vulnerability. The vector shows an attacker can reach the web service over a network, requires low privilege and low complexity, and does not require user interaction. Although no EPSS score is published, the high base score and exposed HTTP endpoint suggest that exploitation could occur if attackers are discovered. The vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation and potential for scope expansion warrant immediate attention.