An easily exploitable flaw in the Event Management component of Oracle Enterprise Manager Base Platform allows an attacker who already possesses high privileges and can reach the system over a network to take over the platform. The vulnerability can lead to the compromise of confidentiality, integrity, and availability of the affected system.

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are affected.

The CVSS base score of 9.1 indicates a very high severity. The exploit vector is network-based HTTP access, although the attacker must already hold high privileges. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, but the high score and known impact suggest it is likely to be targeted by sophisticated threat actors.