A low-privileged attacker with HTTP network access can exploit CVE-2026-101528, a critical (CVSS 9.9) vulnerability in Oracle Enterprise Manager for Oracle Database, to take over the product.
What Is It
CVE-2026-101528 is a vulnerability in the Data Guard Management component of Oracle Enterprise Manager for Oracle Database, part of the Oracle Enterprise Manager product family. Oracle describes it as "easily exploitable." An attacker needs only low privileges and network access over HTTP to compromise the product. No user interaction is required.
Oracle submitted the record to NVD on 2026-10-20, where it currently has "Received" status.
Why It Matters
The CVSS 3.1 base score is 9.9 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice, that means:
- Network attack vector, low complexity: an attacker can reach and exploit the flaw remotely without special conditions.
- Low privileges, no user interaction: any authenticated low-privileged account may be enough.
- Scope change: Oracle says that although the flaw is in Enterprise Manager for Oracle Database, attacks "may significantly impact additional products."
- High confidentiality, integrity, and availability impact: a successful attack can result in full takeover of Oracle Enterprise Manager for Oracle Database.
Enterprise Manager is a management plane for Oracle Database environments, so a compromise could expose the systems it administers. The scope-change rating reflects that risk.
Exploitation status: The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. The source material does not confirm active exploitation.
What's Vulnerable
According to Oracle's affected-product data:
| Vendor | Product | Affected Versions |
|---|---|---|
| Oracle Corporation | Oracle Enterprise Manager for Oracle Database | 13.5, 24.1 |
The vulnerable component is Data Guard Management. The NVD record lists no CPE configurations yet.
Patch Status
The NVD record references Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). Administrators running Enterprise Manager for Oracle Database 13.5 or 24.1 should check that advisory for the patches and guidance that apply to them.
The CVE does not appear in the CISA KEV catalog, so no federal required action or due date has been issued for it. Given the 9.9 score, low attack complexity, and scope change, apply the patch promptly. Restricting HTTP access to Enterprise Manager interfaces also reduces exposure.