{"id":"CVE-2026-101529","kind":"vulnerability","aliases":["CVE-2026-101529"],"related":[],"title":"Oracle Enterprise Manager: Data Guard flaw lets low-privilege user take over server","description":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Enterprise Manager for Oracle Database (Data Guard Management component), versions 13.5 and 24.1, has a flaw reachable over HTTP by a low-privilege account. A successful attack takes over Enterprise Manager and can affect other connected products (CVSS 9.9). Fixed in Oracle's October 2026 Critical Patch Update.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Enterprise Manager for Oracle Database","fixed":["13.5 RU35 (13.5.0.35) per CPU Oct 2026, unconfirmed for this CVE"],"affected":"13.5, 24.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["data-guard","oracle-database","oracle-enterprise-manager","other","runtime","self-hosted"],"not_affected_if":["managed-hosting","other-versions"],"how_to_check":"In Enterprise Manager Cloud Control, check the OMS version with: emctl status oms -details, or look at Setup > About Enterprise Manager. If it is 13.5 or 24.1 and the October 2026 CPU (13.5 RU35 or the 24.1 equivalent) is not applied, you are exposed. List applied patches with: omspatcher lspatches or opatch lspatches in the OMS home.","fix":"Apply the Oracle October 2026 Critical Patch Update for Enterprise Manager from My Oracle Support (patch availability doc CPU391...). For 13.5, Release Update 35 (13.5.0.35), OMS patch 39928237, was released with the CPU. The exact fixed build for 24.1 and the CVE-to-patch mapping are unknown; the MOS patch availability document would settle it. Until patched, restrict network access to the OMS console to trusted admin networks.","status":"open","published_at":"2026-10-20T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:55+00:00","updated_at":"2026-10-23T23:08:21+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T22:38:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Enterprise Manager: Data Guard flaw lets low-privilege user take over server","impact":"high","summary":"Oracle Enterprise Manager for Oracle Database, in its Data Guard Management component, has a flaw that an attacker can reach over HTTP with only a low-privilege account. A successful attack takes over the Enterprise Manager server and can also affect other products it connects to.","category":"other","who_cares":["oracle-enterprise-manager","oracle-database","data-guard"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over Enterprise Manager and reaches connected products","analyst_note":"Find Oracle's patch for 13.5 and 24.1 and the fixed release in the Oracle Security Alerts page; the source gives only the NVD link.","how_to_check":"Confirm whether the Enterprise Manager for Oracle Database version is 13.5 or 24.1, the affected versions listed in the sources.\nunknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000897,"input_tokens":3152,"output_tokens":1164,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's patch for 13.5 and 24.1 and the fixed release in the Oracle Security Alerts page; the source gives only the NVD link.","search":"'-101529':17A,20A '-2026':16A,19A '/av':188C '13.5':53B,116C '2026':88B '24.1':55B,118C '3.1':175C,187C '9.9':82B,178C 'access':128C 'account':67B 'addit':154C 'affect':77B,114C 'allow':122C 'attack':70B,125C,150C,159C 'avail':182C 'base':176C 'c/c':193C 'chang':157C 'compon':51B,106C 'compromis':132C 'confidenti':179C 'connect':79B 'critic':89B 'cve':15A,18A 'cvss':81B,174C,184C,186C 'data':4A,28B,48B,107C 'data-guard':27B 'databas':32B,47B,100C,138C,149C,173C 'database':26A 'easili':119C 'enterpris':2A,35B,43B,73B,96C,104C,134C,145C,169C 'enterprise':22A 'exploit':120C 'fix':83B 'flaw':6A,58B 'for':24A 'guard':5A,29B,49B,108C 'h':196C 'h/a':195C 'h/i':194C 'host':41B 'http':61B,130C 'impact':153C,183C 'integr':180C 'l/pr':190C 'l/ui':191C 'let':7A 'low':9A,65B,123C 'low-privileg':8A,64B 'manag':3A,36B,44B,50B,74B,97C,105C,109C,135C,146C,170C 'manager':23A 'may':151C 'n/ac':189C 'n/s':192C 'network':127C 'octob':87B 'oracl':1A,31B,34B,42B,46B,85B,95C,99C,103C,133C,137C,144C,148C,168C,172C 'oracle':21A,25A 'oracle-databas':30B 'oracle-enterprise-manag':33B 'patch':90B 'privileg':10A,66B,124C 'product':80B,101C,155C 'reachabl':59B 'result':164C 'runtim':38B 'scope':156C 'score':177C 'self':40B 'self-host':39B 'server':14A 'signific':152C 'success':69B,158C 'support':110C 'take':12A,71B 'takeov':166C 'updat':91B 'user':11A 'vector':185C 'version':52B,111C 'via':129C 'vulner':92C,121C,141C,162C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101529","severity":null,"published_at":"2026-10-20T22:18:02+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101529:375","url":null,"severity":null,"published_at":"2026-10-23T23:08:21+00:00","modified_at":"2026-10-23T23:08:21+00:00","first_seen_at":"2026-10-23T23:08:21+00:00","fetched_at":"2026-10-23T23:08:21+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists EM for Oracle Database 13.5 and 24.1 as affected, CVSS 9.9 (AV:N/PR:L/S:C). Exact fixed release not confirmed: the CPU patch availability doc is behind My Oracle Support. Oracle's EM community post says 13.5 RU35 (13.5.0.35, OMS patch 39928237) shipped with the CPU, but it does not name this CVE. 24.1 patch unknown. No exploitation or public PoC found; not in CISA KEV. Sibling CVE-2026-101528 has the same description."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1801,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101529","title":"CVE Record: CVE-2026-101529","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1800,"url":"https://community.oracle.com/mosc/discussion/4601649/enterprise-manager-13-5-release-1-update-35-ru-35-cpu-is-now-available","title":"Enterprise Manager 13.5 RU 35 & CPU is now Available","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}