CVE-2026-61298: Oracle Enterprise Manager Auth Bypass

CVE-2026-61298 Overview

CVE-2026-61298 affects the Oracle Enterprise Manager Base Platform component of Oracle Enterprise Manager, specifically within the Enterprise Manager Install functionality. Supported versions 13.5 and 24.1 are affected. A low-privileged attacker with local logon access to the infrastructure where Oracle Enterprise Manager Base Platform executes can exploit this flaw. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data. The vulnerability has a scope change, meaning attacks may impact additional Oracle products beyond the affected component.

Critical Impact
Local attackers with low privileges can access sensitive data across Oracle Enterprise Manager Base Platform and connected products through scope-changing exploitation.

Affected Products

Oracle Enterprise Manager Base Platform version 13.5
Oracle Enterprise Manager Base Platform version 24.1
Enterprise Manager Install component

Discovery Timeline

2026-08-18 - CVE-2026-61298 published to NVD
2026-08-20 - Last updated in NVD database
2026-08-18 - Oracle Security Alert CSPUAUG2026 published referencing this vulnerability

Technical Details for CVE-2026-61298

Vulnerability Analysis

The vulnerability resides in the Enterprise Manager Install component of Oracle Enterprise Manager Base Platform. It falls into the Information Disclosure category, exposing confidential data to attackers with valid local logon credentials. The confidentiality impact is high, while integrity and availability remain unaffected.

Oracle rates the attack complexity as high, indicating that exploitation requires specific conditions or preparation beyond a typical attack. The scope change component is significant here. An attacker who compromises the Enterprise Manager Base Platform can reach data belonging to other Oracle products managed by the same infrastructure.

The EPSS score of 0.117% suggests limited near-term exploitation likelihood, but the scope-change property increases the blast radius when exploitation succeeds.

Root Cause

Oracle has not published detailed technical root-cause information for this issue. Based on the affected component name, the flaw resides within installation-related logic of the Enterprise Manager Base Platform. See the Oracle Security Alert CSPUAUG2026 for vendor-supplied details.

Attack Vector

Exploitation requires local access. The attacker must possess valid credentials on the host running Oracle Enterprise Manager Base Platform. No user interaction is needed. After establishing a foothold, the attacker leverages the Enterprise Manager Install component to access confidential data. Because the vulnerability produces a scope change, data accessible to other Oracle products on the same infrastructure may also be exposed.

No public proof-of-concept code is available for this vulnerability. See the vendor advisory for technical details.

Detection Methods for CVE-2026-61298

Indicators of Compromise

Unexpected access to Oracle Enterprise Manager configuration files or install logs by low-privileged local accounts
Anomalous read operations against Enterprise Manager repository data by non-administrative users
Unauthorized process execution originating from user accounts that do not typically interact with Oracle Enterprise Manager services

Detection Strategies

Audit local account activity on hosts running Oracle Enterprise Manager Base Platform 13.5 and 24.1
Enable and review Oracle Enterprise Manager audit logs for access patterns targeting install-related files and directories
Correlate local logon events with subsequent access to Enterprise Manager binaries, configuration, or metadata files

Monitoring Recommendations

Monitor file system access on Oracle Enterprise Manager install directories for reads by unexpected user accounts
Track privilege usage on Enterprise Manager hosts using host-based audit tooling
Establish baselines for normal administrative activity and alert on deviations involving Enterprise Manager components

How to Mitigate CVE-2026-61298

Immediate Actions Required

Apply the fixes described in Oracle Security Alert CSPUAUG2026 to affected Enterprise Manager Base Platform installations
Inventory hosts running Oracle Enterprise Manager Base Platform 13.5 and 24.1 and prioritize them for patching
Restrict local logon rights on Enterprise Manager hosts to authorized administrators only

Patch Information

Oracle addressed this vulnerability in the security alert published as CSPUAUG2026. Administrators should reference the Oracle Security Alert CSPUAUG2026 for the specific patch identifiers and installation instructions applicable to versions 13.5 and 24.1.

Workarounds

Limit interactive and remote local logon access to Enterprise Manager Base Platform servers using operating system access controls
Enforce least-privilege principles for all accounts on Enterprise Manager hosts, removing unused local accounts
Segment Oracle Enterprise Manager infrastructure from general-purpose systems to reduce the population of users with local access

bash

# Configuration example - restrict interactive logon on Linux hosts running OEM
# Review and prune users with shell access
getent passwd | awk -F: '$7 !~ /nologin|false/ {print $1}'

# Enforce PAM access controls via /etc/security/access.conf
# Permit only the oracle admin group; deny all others
# +:oem_admins:ALL
# -:ALL:ALL