Oracle Enterprise Manager for Oracle Database: Takeover via Data Guard Management
Summary
A flaw in the Data Guard Management component of Oracle Enterprise Manager for Oracle Database allows an authenticated attacker with low privileges to compromise the console over HTTP. Because the scope changes, an attack can also affect other products that the console manages. The CVSS base score is 9.9 (critical), and successful exploitation can lead to a full takeover of Enterprise Manager.
Affected
- Oracle Enterprise Manager for Oracle Database 13.5
- Oracle Enterprise Manager for Oracle Database 24.1
Fixed in
Unknown. Check the Patch Availability section of the Oracle Critical Patch Update October 2026 advisory or My Oracle Support for the patch identifiers.
Workaround
- No vendor workaround known. Upgrading or patching removes the vulnerability.
- Restrict access to the Enterprise Manager console to management networks or VPN.
- Review and remove unneeded low-privilege Enterprise Manager accounts.
Exploitation
- No known exploitation as of 21 October 2026.
- Not listed in the CISA KEV catalog as of 21 October 2026 (re-check recommended).
- No public proof of concept found.
Our recommendation
- Check whether Oracle Enterprise Manager for Oracle Database 13.5 or 24.1 with Data Guard Management is in use.
- Apply the October 2026 Oracle Critical Patch Update as soon as the fixed versions are confirmed.
- Do not expose the console to the internet; restrict access to management networks.
- Review Enterprise Manager accounts and monitor logs for unusual Data Guard actions until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- Oracle CPU October 2026 risk matrix (verbose) www.oracle.com
- NVD record via Vulners mirror vulners.com
- VulDB entry vuldb.com
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:08.
Original description (NVD)
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database. While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.