{"id":"CVE-2026-101529","published":"2026-10-20T22:18:02.293","lastModified":"2026-10-21T14:29:49.513","description":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical vulnerability in Oracle Enterprise Manager's Data Guard Management component allows low-privileged attackers with network access to fully compromise the Oracle Enterprise Manager system, potentially affecting other Oracle products through scope change.","exploitability":"The vulnerability is easily exploitable with low privilege requirements and can be triggered via HTTP network access, making it straightforward for attackers to gain full control of the Oracle Enterprise Manager instance.","blast_radius":"Successful exploitation could lead to complete takeover of Oracle Enterprise Manager for Oracle Database, with potential impact extending to other Oracle products due to the scope change, affecting critical database management operations.","remediation":"Upgrade to Oracle Enterprise Manager 24.1 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["database","enterprise-manager","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:20:26.088Z"}}