A vulnerability exists in the Metadata Plugin component of Oracle Enterprise Manager Base Platform. The flaw is easily exploitable by an attacker with low privileges and network reach via HTTPS. Once successfully exploited, the attacker can achieve full compromise of the platform, leading to total loss of confidentiality, integrity, and availability. The attack requires only standard HTTPS communication and does not require elevated permissions, making the threat surface wide. The vulnerability’s CVSS score of 9.9 indicates a critical severity.

Oracle Enterprise Manager Base Platform from Oracle Corporation is affected. The vulnerability impacts supported releases 13.5 and 24.1. Only these versions have been confirmed to be vulnerable; newer or older builds are not listed as affected.

The CVSS score of 9.9 combined with the low privilege requirement indicates a very high exploitation risk. However, the EPSS score of fewer than 1% suggests that exploitation attempts are currently rare, and the issue is not recorded in the CISA KEV catalog. The likely attack vector is over HTTPS, where a crafted request to the Metadata Plugin triggers the compromise and triggers a scope change, elevating low‑privileged access to full control of the system.