CVE-2026-61300 in Enterprise Manager Base Platform
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Agent Next Gen component of Oracle Enterprise Manager Base Platform, affecting supported versions including release 13.5 and version 24.1. This security flaw represents a critical risk to organizations relying on this infrastructure management suite for monitoring and administering their IT environments. The core issue stems from an easily exploitable weakness that permits low-privileged attackers who have already established logon access to the underlying operating system or infrastructure where Oracle Enterprise Manager Base Platform executes to compromise the application itself. This scenario highlights a significant escalation path, as it does not require network-level remote exploitation but rather local authentication on the host machine running the agent software.
From a technical perspective, this vulnerability allows an attacker with minimal privileges to gain full control over the Oracle Enterprise Manager Base Platform instance. The ability of a low-privileged user to take over the platform indicates a failure in proper privilege separation or access control mechanisms within the Agent Next Gen architecture. Such flaws often involve improper handling of session tokens, insufficient validation of administrative commands executed by lower-level processes, or insecure configuration defaults that allow standard users to interact with sensitive management interfaces. The ease of exploitation suggests that the attack vector does not require complex payload construction or social engineering, making it a high-risk threat for any environment where multiple users share access to the server hosting the Oracle Enterprise Manager components.
The operational impact of this vulnerability is severe, as indicated by its CVSS 3.1 Base Score of 7.8, which classifies it as High severity. The vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack requires local access and low privileges but results in high impacts across confidentiality, integrity, and availability. A successful compromise allows an attacker to take over Oracle Enterprise Manager Base Platform, potentially leading to unauthorized monitoring of infrastructure metrics, manipulation of configuration settings, execution of arbitrary commands on managed targets through the agent interface, or disruption of critical management operations. This level of access can serve as a pivot point for further lateral movement within the enterprise network, compromising other systems monitored by the platform and exposing sensitive operational data.
To mitigate this risk, organizations should immediately apply the latest security patches provided by Oracle for their specific versions of Enterprise Manager Base Platform. It is crucial to verify that all Agent Next Gen components are updated to the patched version recommended in the vendor's security advisory. In addition to patching, implementing strict least-privilege principles on the infrastructure hosting the platform is essential. Administrators should ensure that only highly trusted service accounts with elevated privileges interact directly with the core management processes, while standard user accounts have restricted access rights. Network segmentation can also help isolate the Oracle Enterprise Manager servers from general-purpose workstations to reduce the attack surface for local privilege escalation attempts. Regular auditing of user permissions and monitoring for unusual administrative activities within the platform will further enhance security posture against such exploitation vectors aligned with CWE categories related to improper authorization and ATT&CK techniques involving local account manipulation and defense evasion.