{"id":"CVE-2026-101527","kind":"vulnerability","aliases":["CVE-2026-101527"],"related":[],"title":"Oracle Enterprise Manager: install component flaw lets local users take over","description":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a flaw in the Enterprise Manager Install component. A low-privileged user who can log on to the host running Enterprise Manager can take over the product.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","on-prem","oracle-enterprise-manager","self-hosted"],"not_affected_if":["no-shared-host-logons","other-versions"],"how_to_check":"- Confirm the installed Enterprise Manager version, for example by checking the Oracle Enterprise Manager console or the OMS home, and see whether it is 13.5 or 24.1.\n- Check who has logon accounts on the hosts that run the Enterprise Manager management server.","fix":"- Apply the Oracle Critical Patch Update that covers Enterprise Manager Base Platform 13.5 and 24.1, as listed in Oracle's advisory (unknown exact patch id in the sources).","status":"open","published_at":"2026-10-20T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:10:01+00:00","updated_at":"2026-10-25T03:10:01+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:10:01Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that covers Enterprise Manager Base Platform 13.5 and 24.1, as listed in Oracle's advisory (unknown exact patch id in the sources).","reach":"local","title":"Oracle Enterprise Manager: install component flaw lets local users take over","impact":"high","summary":"Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a flaw in the Enterprise Manager Install component. A low-privileged user who can log on to the host running Enterprise Manager can take over the product.","category":"infrastructure","nicknames":[],"who_cares":["oracle-enterprise-manager","self-hosted","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged logon lets attacker take over Enterprise Manager","analyst_note":"Find the Oracle Critical Patch Update advisory naming the fixed Enterprise Manager 13.5 and 24.1 patch levels and the exact patch IDs.","how_to_check":"- Confirm the installed Enterprise Manager version, for example by checking the Oracle Enterprise Manager console or the OMS home, and see whether it is 13.5 or 24.1.\n- Check who has logon accounts on the hosts that run the Enterprise Manager management server.","needs_analyst":true,"not_affected_if":["other-versions","no-shared-host-logons"],"who_is_affected":"Teams running Oracle Enterprise Manager Base Platform 13.5 or 24.1 on servers where other people hold local or low-privileged logon. The sources say the attacker needs logon to the infrastructure where the product runs, so a host with only administrators logging on is lower risk. Teams on other Enterprise Manager versions are not named as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":3502,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101527':13A,16A '-2026':12A,15A '/av':147C '13.5':34B,89C '24.1':36B,91C '3.1':134C,146C '7.8':137C 'affect':87C 'allow':95C 'attack':98C,119C 'avail':141C 'base':31B,72C,108C,116C,131C,135C 'compon':5A,45B,79C 'compromis':112C 'confidenti':138C 'contain':37B 'cve':11A,14A 'cvss':133C,143C,145C 'easili':92C 'enterpris':2A,23B,29B,42B,59B,70C,77C,80C,106C,114C,129C 'execut':110C 'exploit':93C 'flaw':6A,39B 'h':155C 'h/a':154C 'h/i':153C 'host':27B,57B 'impact':142C 'infrastructur':17B,103C 'instal':4A,44B,82C 'integr':139C 'l/ac':148C 'l/pr':149C 'l/ui':150C 'let':7A 'local':8A 'log':53B 'logon':100C 'low':48B,96C 'low-privileg':47B 'manag':3A,24B,30B,43B,60B,71C,78C,81C,107C,115C,130C 'n/s':151C 'on-prem':18B 'oracl':1A,22B,28B,69C,76C,105C,113C,128C 'oracle-enterprise-manag':21B 'platform':32B,73C,109C,117C,132C 'prem':20B 'privileg':49B,97C 'product':65B,74C 'result':124C 'run':58B 'score':136C 'self':26B 'self-host':25B 'success':118C 'support':83C 'take':10A,62B 'takeov':126C 'u/c':152C 'user':9A,50B 'vector':144C 'version':33B,84C 'vulner':66C,94C,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Enterprise Manager Base Platform 13.5 or 24.1 on servers where other people hold local or low-privileged logon. The sources say the attacker needs logon to the infrastructure where the product runs, so a host with only administrators logging on is lower risk. Teams on other Enterprise Manager versions are not named as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101527","severity":null,"published_at":"2026-10-20T22:18:02+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}