---
id: "CVE-2026-101518"
kind: "vulnerability"
aliases: ["CVE-2026-101518"]
title: "Oracle Enterprise Manager: low-privilege HTTP request lets attackers take over the platform"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle Enterprise Manager Base Platform", "fixed": [], "affected": "13.5, 24.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["http", "oracle", "oracle-enterprise-manager", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T22:18:01+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:09:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101518", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:09:28+00:00"}]
---

# Oracle Enterprise Manager: low-privilege HTTP request lets attackers take over the platform

Oracle Enterprise Manager Base Platform's Agent Next Gen component (versions 13.5 and 24.1) has a flaw that lets an attacker with a low-privilege account over the network take full control of the product. The sources say a successful attack gives takeover with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Enterprise Manager Base Platform affected 13.5, 24.1 fixed ?

## How to check

Check your Enterprise Manager OMS version (13.5 or 24.1 is affected) and whether the October 2026 CPU patch is applied with: /OPatch/opatch lspatches, then compare against the patch numbers in the Enterprise Manager patch availability document in My Oracle Support (login required).

## Fix

Apply the Oracle Enterprise Manager patches from the October 2026 Critical Patch Update (published 2026-10-20). Fixed version numbers and patch IDs are in the MOS patch availability document, which is not public. Oracle names no fixed release; the fix is a patch on 13.5 and 24.1.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101518
- 2026-10-24T00:09:28+00:00 analyst — Read Oracle's CPU Oct 2026 advisory (the EM row lists Base Platform 13.5 and 24.1), the CVE record and NVD. All say 8.8 (AV:N/PR:L), Agent Next Gen component, with no exploitation reported (not in KEV, per Armis and Rapid7). The patch numbers are behind MOS login and I could not read them, so fixed versions and the exact patch IDs are unknown. Social search was not done. The same CPU also covers EM for Oracle Database, Siebel and Virtualization.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101518 https://www.cve.org/CVERecord?id=CVE-2026-101518
- [mentions] CVE-2026-101518 | Armis https://cve.armis.com/CVE-2026-101518

## From the sources

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_