{"id":"CVE-2026-101528","kind":"vulnerability","aliases":["CVE-2026-101528"],"related":[],"title":"Oracle Enterprise Manager: Data Guard flaw lets low-privilege users take over","description":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Enterprise Manager for Oracle Database (Data Guard Management component), versions 13.5 and 24.1, has a flaw that a low-privileged user can reach over HTTP. A successful attack takes over Enterprise Manager and can affect other products (scope change). CVSS 9.9. Fixed in Oracle's October 2026 Critical Patch Update.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Enterprise Manager for Oracle Database","fixed":["unknown: see Oct 2026 CPU patch availability document"],"affected":"13.5, 24.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["data-guard","oracle-database","oracle-enterprise-manager","self-hosted","vendor"],"not_affected_if":["console-not-network-reachable","managed-hosting","unknown"],"how_to_check":"In the EM console, open Setup > About Enterprise Manager and note the version (13.5 or 24.1 is affected). Then run 'emctl version' or 'opatch lsinventory' on the OMS host and compare against the Enterprise Manager patch listed in the October 2026 CPU patch availability document (My Oracle Support login needed). Also check whether the EM web console is reachable from untrusted networks.","fix":"Apply the Enterprise Manager patches from the Oracle October 2026 CPU (20 Oct 2026) to 13.5 and 24.1. The patch number is in the MOS patch availability document, not on the public advisory page. Until patched, restrict network access to the EM console and review which accounts have low-privilege logins.","status":"open","published_at":"2026-10-20T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:54+00:00","updated_at":"2026-10-23T23:08:10+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-10-23T22:38:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update that addresses this CVE for Enterprise Manager 13.5 and 24.1; the sources do not name the patch.","reach":"network","title":"Oracle Enterprise Manager: Data Guard flaw lets low-privilege users take over","impact":"high","summary":"Oracle Enterprise Manager for Oracle Database, in its Data Guard Management component, has a flaw that a low-privileged user can reach over HTTP from the network. A successful attack takes over Enterprise Manager and can affect other products it touches.","category":"vendor","who_cares":["oracle-enterprise-manager","oracle-database","data-guard"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Enterprise Manager and reaches connected systems","analyst_note":"Find the Oracle CPU advisory and patch list for CVE-2026-101528 and confirm affected Enterprise Manager builds and the Data Guard Management patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000524,"input_tokens":3152,"output_tokens":417,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle CPU advisory and patch list for CVE-2026-101528 and confirm affected Enterprise Manager builds and the Data Guard Management patch.","search":"'-101528':15A,18A '-2026':14A,17A '/av':187C '13.5':50B,115C '2026':87B '24.1':52B,117C '3.1':174C,186C '9.9':81B,177C 'access':127C 'addit':153C 'affect':75B,113C 'allow':121C 'attack':68B,124C,149C,158C 'avail':181C 'base':175C 'c/c':192C 'chang':79B,156C 'compon':48B,105C 'compromis':131C 'confidenti':178C 'critic':88B 'cve':13A,16A 'cvss':80B,173C,183C,185C 'data':4A,26B,45B,106C 'data-guard':25B 'databas':30B,44B,99C,137C,148C,172C 'database':24A 'easili':118C 'enterpris':2A,33B,40B,71B,95C,103C,133C,144C,168C 'enterprise':20A 'exploit':119C 'fix':82B 'flaw':6A,55B 'for':22A 'guard':5A,27B,46B,107C 'h':195C 'h/a':194C 'h/i':193C 'host':37B 'http':65B,129C 'impact':152C,182C 'integr':179C 'l/pr':189C 'l/ui':190C 'let':7A 'low':9A,59B,122C 'low-privileg':8A,58B 'manag':3A,34B,41B,47B,72B,96C,104C,108C,134C,145C,169C 'manager':21A 'may':150C 'n/ac':188C 'n/s':191C 'network':126C 'octob':86B 'oracl':1A,29B,32B,39B,43B,84B,94C,98C,102C,132C,136C,143C,147C,167C,171C 'oracle':19A,23A 'oracle-databas':28B 'oracle-enterprise-manag':31B 'patch':89B 'privileg':10A,60B,123C 'product':77B,100C,154C 'reach':63B 'result':163C 'scope':78B,155C 'score':176C 'self':36B 'self-host':35B 'signific':151C 'success':67B,157C 'support':109C 'take':12A,69B 'takeov':165C 'updat':90B 'user':11A,61B 'vector':184C 'vendor':38B 'version':49B,110C 'via':128C 'vulner':91C,120C,140C,161C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101528","severity":null,"published_at":"2026-10-20T22:18:02+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101528:376","url":null,"severity":null,"published_at":"2026-10-23T23:08:10+00:00","modified_at":"2026-10-23T23:08:10+00:00","first_seen_at":"2026-10-23T23:08:10+00:00","fetched_at":"2026-10-23T23:08:10+00:00","note":"Confirmed in Oracle CPU Oct 2026 (rev 1, 20 Oct 2026): Enterprise Manager for Oracle Database 13.5 and 24.1 affected. The specific patch number sits in the My Oracle Support patch availability document, which needs a login, so I did not read it. No exploitation or public PoC found (not in KEV, EPSS under 1%). I did not search social posts; nothing suggested a conversation."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1794,"url":"https://blogs.oracle.com/security/october-2026-critical-patch-update-released","title":"October 2026 Critical Patch Update Released","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1795,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101528","title":"CVE Record: CVE-2026-101528","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}