Vulnerability resides in the Install component of Oracle Enterprise Manager Base Platform. An attacker who has high privileges and can reach the system over HTTPS may compromise the platform, enabling the creation, deletion, or modification of critical data, as well as unauthorized reading of sensitive information. The weakness allows the attacker to cause a hang or complete denial‑of‑service through repeated crashes.

Oracle Corporation’s Oracle Enterprise Manager Base Platform, specifically versions 13.5 and 24.1, are affected. Any environment deploying these instances is at risk.

The CVSS 3.1 base score is 9.0, reflecting high impact on confidentiality, integrity, and availability. EPSS indicates exploitation probability is very low (<1 %). The vulnerability is not listed in CISA KEV, but the scope change suggests that other Oracle applications could be impacted if the platform is compromised. Based on the description, the likely attack vector is HTTPS, requiring the attacker to possess high‑level credentials within the network.