---
id: "CVE-2026-101529"
kind: "vulnerability"
aliases: ["CVE-2026-101529"]
title: "Oracle Enterprise Manager: Data Guard flaw lets low-privilege user take over server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Enterprise Manager for Oracle Database", "fixed": ["13.5 RU35 (13.5.0.35) per CPU Oct 2026, unconfirmed for this CVE"], "affected": "13.5, 24.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["data-guard", "oracle-database", "oracle-enterprise-manager", "other", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "other-versions"]
published_at: "2026-10-20T22:18:02+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:08:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101529", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:08:21+00:00"}]
---

# Oracle Enterprise Manager: Data Guard flaw lets low-privilege user take over server

Oracle Enterprise Manager for Oracle Database (Data Guard Management component), versions 13.5 and 24.1, has a flaw reachable over HTTP by a low-privilege account. A successful attack takes over Enterprise Manager and can affect other connected products (CVSS 9.9). Fixed in Oracle's October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Enterprise Manager for Oracle Database affected 13.5, 24.1 fixed 13.5 RU35 (13.5.0.35) per CPU Oct 2026, unconfirmed for this CVE

## How to check

In Enterprise Manager Cloud Control, check the OMS version with: emctl status oms -details, or look at Setup > About Enterprise Manager. If it is 13.5 or 24.1 and the October 2026 CPU (13.5 RU35 or the 24.1 equivalent) is not applied, you are exposed. List applied patches with: omspatcher lspatches or opatch lspatches in the OMS home.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Enterprise Manager from My Oracle Support (patch availability doc CPU391...). For 13.5, Release Update 35 (13.5.0.35), OMS patch 39928237, was released with the CPU. The exact fixed build for 24.1 and the CVE-to-patch mapping are unknown; the MOS patch availability document would settle it. Until patched, restrict network access to the OMS console to trusted admin networks.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101529
- 2026-10-23T23:08:21+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists EM for Oracle Database 13.5 and 24.1 as affected, CVSS 9.9 (AV:N/PR:L/S:C). Exact fixed release not confirmed: the CPU patch availability doc is behind My Oracle Support. Oracle's EM community post says 13.5 RU35 (13.5.0.35, OMS patch 39928237) shipped with the CPU, but it does not name this CVE. 24.1 patch unknown. No exploitation or public PoC found; not in CISA KEV. Sibling CVE-2026-101528 has the same description.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101529 https://www.cve.org/CVERecord?id=CVE-2026-101529
- [fix] Enterprise Manager 13.5 RU 35 & CPU is now Available https://community.oracle.com/mosc/discussion/4601649/enterprise-manager-13-5-release-1-update-35-ru-35-cpu-is-now-available

## From the sources

Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_