CVE-2026-83355

Received Received - Intake

Oracle Enterprise Manager Fusion Middleware Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: Metrics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager for Fusion Middleware. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Fusion Middleware. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83355

EUVD

EUVD-2026-79708

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	enterprise_manager_for_fusion_middleware	13.5
oracle	enterprise_manager_for_fusion_middleware	24.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle Enterprise Manager for Fusion Middleware versions 13.5 and 24.1. It allows an unauthenticated attacker to remotely access and compromise the system via HTTP, potentially leading to full system takeover. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Impact Analysis

If you use Oracle Enterprise Manager for Fusion Middleware versions 13.5 or 24.1, an attacker could exploit this to gain complete control over your system. This could lead to data breaches, unauthorized modifications, or system disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Enterprise Manager for Fusion Middleware versions 13.5 and 24.1. If patches are not immediately available, consider isolating the affected systems from untrusted networks and disabling HTTP access until updates are applied.

Hi! I’m here to help you understand CVE-2026-83355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70