The vulnerability is found in the Deployment Library component of Oracle Enterprise Manager Base Platform and permits a remote attacker who already holds high‑privilege credentials to compromise the platform through a network interface exposed over HTTPS. The flaw allows the attacker to gain full control of the system, leading to loss of confidentiality, integrity, and availability. The weakness is classified as CWE‑284 (Improper Access Control), underscoring the privilege escalation potential.

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are affected. These platforms are widely used for monitoring, deployment, and management of cloud and on‑premises assets. Because the vulnerability resides in the Deployment Library, other Oracle products that rely on this component could also be impacted when the platform is in scope.

The CVSS 3.1 score of 9.1 indicates critical severity, with a network attack vector, low complexity, high privileges, no user interaction, and scope change. The EPSS score of less than 1% suggests the vulnerability is currently rarely exploited in the wild and is not listed in CISA’s KEV catalog. Exploitation requires possession of high‑privilege accounts or the ability to acquire them beforehand; after establishing HTTPS connectivity, the attacker can trigger the flaw to achieve full platform takeover.