CVE-2026-70737 in Enterprise Manager for Systems Infrastructure
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager (component: Storage Server Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Systems Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Systems Infrastructure. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Storage Server Management component of Oracle Enterprise Manager for Systems Infrastructure, specifically affecting versions 13.5 and 24.1. This security flaw represents a critical risk to organizations relying on this platform for centralized infrastructure monitoring and management. The core issue stems from an easily exploitable weakness that allows unauthorized access to sensitive system resources or administrative functions without requiring complex exploitation techniques. Because the vulnerability is accessible via HTTP, it can be triggered remotely by any attacker who has network connectivity to the affected service endpoint. This accessibility significantly broadens the attack surface compared to vulnerabilities restricted to local execution or authenticated sessions with higher privilege levels.
The operational impact of this vulnerability is severe, as indicated by a CVSS 3.1 Base Score of 8.8, which classifies it as High severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reveals that the attack requires only low-privileged credentials and no user interaction to succeed. Once exploited, an attacker can achieve complete compromise of the Oracle Enterprise Manager for Systems Infrastructure environment. This means full control over confidentiality, integrity, and availability is attainable by a single authenticated but unprivileged actor. The ability to take over the management console allows adversaries to manipulate storage configurations, exfiltrate sensitive infrastructure data, disrupt critical business operations through denial-of-service conditions, or pivot further into the internal network using the compromised system as a foothold.
From a classification perspective, this vulnerability aligns with CWE-269, which covers Improper Privilege Management, and potentially CWE-78, if the exploitation involves operating system command injection due to insufficient input validation in HTTP request handling. In terms of adversary behavior mapping under MITRE ATT&CK, this scenario corresponds to Initial Access techniques involving Valid Accounts combined with Network Service Discovery or Exploitation for Credential Access. The low complexity and lack of user interaction requirements place it firmly within the realm of automated exploitation tools commonly used by threat actors seeking rapid lateral movement across enterprise environments.
Mitigation strategies must prioritize immediate patching to the latest supported version released by Oracle, which addresses the underlying code flaws responsible for this privilege escalation or access control bypass. Until patches are applied, organizations should implement strict network segmentation policies to restrict HTTP access to the Storage Server Management component exclusively from trusted management networks. Additionally, deploying Web Application Firewalls with rules designed to detect and block anomalous request patterns associated with exploitation attempts can provide a layer of defense in depth. Enforcing multi-factor authentication for all administrative accounts and applying principle of least privilege principles to service accounts used by the Oracle Enterprise Manager services will further reduce the blast radius if an initial breach occurs. Regular vulnerability scanning focused on infrastructure management platforms is also recommended to identify similar misconfigurations or unpatched components before they can be leveraged by attackers.