---
id: "CVE-2026-101528"
kind: "vulnerability"
aliases: ["CVE-2026-101528"]
title: "Oracle Enterprise Manager: Data Guard flaw lets low-privilege users take over"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Enterprise Manager for Oracle Database", "fixed": ["unknown: see Oct 2026 CPU patch availability document"], "affected": "13.5, 24.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["data-guard", "oracle-database", "oracle-enterprise-manager", "self-hosted", "vendor"]
not_affected_if: ["console-not-network-reachable", "managed-hosting", "unknown"]
published_at: "2026-10-20T22:18:02+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:08:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101528", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:08:10+00:00"}]
---

# Oracle Enterprise Manager: Data Guard flaw lets low-privilege users take over

Oracle Enterprise Manager for Oracle Database (Data Guard Management component), versions 13.5 and 24.1, has a flaw that a low-privileged user can reach over HTTP. A successful attack takes over Enterprise Manager and can affect other products (scope change). CVSS 9.9. Fixed in Oracle's October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Enterprise Manager for Oracle Database affected 13.5, 24.1 fixed unknown: see Oct 2026 CPU patch availability document

## How to check

In the EM console, open Setup > About Enterprise Manager and note the version (13.5 or 24.1 is affected). Then run 'emctl version' or 'opatch lsinventory' on the OMS host and compare against the Enterprise Manager patch listed in the October 2026 CPU patch availability document (My Oracle Support login needed). Also check whether the EM web console is reachable from untrusted networks.

## Fix

Apply the Enterprise Manager patches from the Oracle October 2026 CPU (20 Oct 2026) to 13.5 and 24.1. The patch number is in the MOS patch availability document, not on the public advisory page. Until patched, restrict network access to the EM console and review which accounts have low-privilege logins.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101528
- 2026-10-23T23:08:10+00:00 analyst — Confirmed in Oracle CPU Oct 2026 (rev 1, 20 Oct 2026): Enterprise Manager for Oracle Database 13.5 and 24.1 affected. The specific patch number sits in the My Oracle Support patch availability document, which needs a login, so I did not read it. No exploitation or public PoC found (not in KEV, EPSS under 1%). I did not search social posts; nothing suggested a conversation.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101528 https://www.cve.org/CVERecord?id=CVE-2026-101528
- [mentions] October 2026 Critical Patch Update Released https://blogs.oracle.com/security/october-2026-critical-patch-update-released

## From the sources

Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_