CVE-2026-34279
Privilege Escalation in Oracle Enterprise Manager Event Management
Publication date: 2026-04-21
Last updated on: 2026-04-24
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | enterprise_manager_base_platform | 13.5.0.0 |
| oracle | enterprise_manager_base_platform | 24.1.0.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Enterprise Manager Base Platform, specifically in the Event Management component. It affects supported versions 13.5 and 24.1. The flaw is easily exploitable by a high privileged attacker who has network access via HTTP. Exploiting this vulnerability can allow the attacker to compromise the Oracle Enterprise Manager Base Platform.
The vulnerability has a significant scope change, meaning that while it is in the Base Platform, successful attacks may also impact additional Oracle products.
The severity is high, with a CVSS 3.1 base score of 9.1, indicating critical impacts on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with network access to compromise the Oracle Enterprise Manager Base Platform, potentially leading to a complete takeover of the platform.
Given the CVSS score of 9.1 with high impacts on confidentiality, integrity, and availability, successful exploitation could lead to unauthorized access or manipulation of sensitive data.
Such a compromise could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and maintaining system integrity and availability.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to a complete takeover of the Oracle Enterprise Manager Base Platform.
This means an attacker could gain unauthorized access to sensitive information, alter or destroy data, and disrupt the availability of the platform.
Because the scope of the attack can extend beyond the Base Platform, other connected Oracle products may also be compromised, increasing the overall impact.