Oracle Enterprise Manager for Oracle Database: Takeover via Data Guard Management
Summary
Oracle Enterprise Manager for Oracle Database versions 13.5 and 24.1 contain a vulnerability in the Data Guard Management component. An attacker with low privileges and network access via HTTP can take over the Enterprise Manager installation. Oracle states that attacks may also significantly impact additional products (scope change), so managed databases could be affected, but this is not documented in detail. Oracle and the CNA rate the flaw 9.9 (Critical), while VulDB rates it 6.3 (Medium).
Affected
- Oracle Enterprise Manager for Oracle Database 13.5
- Oracle Enterprise Manager for Oracle Database 24.1
Fixed in
Unknown.
Workaround
- No vendor workaround known.
- Until patched, restrict HTTP access to the Enterprise Manager console to administration networks.
- Review which accounts have Enterprise Manager login rights.
Exploitation
- No known exploitation as of 21 October 2026. The CVE was not listed in the CISA KEV catalog at that time.
- No public proof of concept found.
Our recommendation
- Confirm that your Enterprise Manager for Oracle Database instances run version 13.5 or 24.1.
- Obtain the patch for your version from Oracle's October 2026 Critical Patch Update and apply it, together with the Database and Fusion Middleware patches for Enterprise Manager.
- Restrict HTTP access to Enterprise Manager and audit its accounts until the patch is applied.
- Recheck the CISA KEV catalog and NVD, as NVD analysis was still pending at the time of research.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
- Oracle October 2026 CPU (verbose) www.oracle.com
- CVE record mirror (CVE List) vulners.com
- NVD record mirror vulners.com
- VulDB entry 423258 vuldb.com
- Strix CVE details www.strix.ai
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:07.
Original description (NVD)
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database. While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.