The vulnerability is a code injection flaw (CWE-94) within the Extensibility Framework component of Oracle Enterprise Manager Base Platform. A high‑privileged attacker who can connect over HTTPS to the platform can exploit the flaw to override confidentiality, integrity and availability, effectively taking control of the entire system. The CVSS vector shows network proximity, a low effort requirement, high privileges, no user interaction, and full scope impact, implying a serious threat if compromised.

Affected are Oracle Corporation's Oracle Enterprise Manager Base Platform versions 13.5 and 24.1.

The CVSS score of 7.2 places the vulnerability in the high‑severity range. The EPSS indicates the exploitation probability is less than 1%, suggesting low random activity but still non‑zero. It is not listed in the CISA KEV catalog, meaning no confirmed exploit has been recorded as of now. The likely attack vector is network‑based via HTTPS, requiring high privileges, so it is mainly relevant for internal adversaries with compromised credentials or elevated access.