The issue resides in the Agent Next Gen component of Oracle Enterprise Manager Base Platform and permits an unauthenticated attacker to exploit a network-facing HTTP interface. Successful exploitation can result in complete compromise of the management platform, allowing the attacker to manipulate configurations, access sensitive data, or disrupt services. The weakness causes confidentiality, integrity, and availability impacts, as reflected in the CVSS score of 8.1.

Oracle Enterprise Manager Base Platform is affected in versions 13.5 and 24.1. The issue applies to installations wherein the Agent Next Gen component is enabled and exposed to the network via HTTP. All deployments using these versions and with this component active fall under risk.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack does not require prior authentication and can leverage a single network request. While no EPSS score is currently available, the high base score demonstrates severe risk. The issue is not listed in the CISA KEV catalog, suggesting no known public exploitation at the time of this analysis. The likely attack path is a remote attacker sending malicious HTTP requests to the exposed endpoint, leading to unauthorized code execution and platform takeover.