Oracle Enterprise Manager Base Platform: Takeover via HTTP in Agent Next Gen
Summary
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are affected by a vulnerability in the Agent Next Gen component. A low-privileged attacker with network access via HTTP can exploit it with low complexity and without user interaction. Successful exploitation can lead to takeover of the product, with high impact on confidentiality, integrity and availability.
Affected
- Oracle Enterprise Manager Base Platform 13.5 (component Agent Next Gen)
- Oracle Enterprise Manager Base Platform 24.1 (component Agent Next Gen)
Exact patch levels: Unknown.
Fixed in
Unknown. The fix vehicle is the October 2026 Critical Patch Update (released 20 October 2026). The patch row for this CVE has not been verified.
Workaround
- No Oracle workaround known.
- Restrict HTTPS access to the Agent Next Gen interface with firewall rules and network segmentation (generic advice, not verified for this CVE).
- Limit access to trusted OMS hosts.
Exploitation
- No evidence of exploitation in the wild found. The CISA KEV catalogue was not checked directly.
- No public proof-of-concept found.
- EPSS 0.0048 (about 0.48%), date of score not stated.
Our recommendation
- Verify the patch for CVE-2026-101518 in the October 2026 Critical Patch Update and apply it to all Enterprise Manager 13.5 and 24.1 installations.
- Until patched, restrict network access to the Agent Next Gen HTTP endpoint to trusted OMS hosts.
- Review accounts with low privileges and remove unneeded access.
- Check whether the endpoint is reachable from untrusted networks and monitor HTTP traffic for anomalies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
- Oracle Security Blog: October 2026 Critical Patch Update released blogs.oracle.com
- Strix: CVE-2026-101518 www.strix.ai
- NVD mirror on Vulners: CVE-2026-101518 vulners.com
- Oracle CPU October 2026 on Vulners vulners.com
- SentinelOne: CVE-2026-46994 (same component, third party) www.sentinelone.com
- SentinelOne: CVE-2026-46986 (same component, third party) www.sentinelone.com
- CVE Program cvelistV5 releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:27.
Original description (NVD)
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.