CVE-2026-101529 is a critical (CVSS 9.9) flaw in the Data Guard Management component of Oracle Enterprise Manager for Oracle Database. A low-privileged attacker with HTTP network access can use it to take over the product.
What Is It
CVE-2026-101529 is a vulnerability in Oracle Enterprise Manager for Oracle Database, which is part of the Oracle Enterprise Manager product family. The flaw is in the Data Guard Management component. Oracle reported it, and NVD published the record on October 20, 2026. NVD lists its status as "Received", so NVD has not yet done its own analysis.
Oracle calls the flaw "easily exploitable." An attacker needs only low privileges and network access over HTTP. No user interaction is required.
Why It Matters
Oracle scores the flaw 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector breaks down as follows:
- Network attack vector, low complexity: the attacker can exploit it remotely, with no special conditions.
- Low privileges required: any authenticated low-level account is enough to start an attack.
- Scope changed: the flaw is in Enterprise Manager, but Oracle says attacks "may significantly impact additional products."
- High impact on confidentiality, integrity and availability: a successful attack can result in full takeover of Oracle Enterprise Manager for Oracle Database.
Enterprise Manager is used to manage Oracle Database environments, and the scope change means the impact can reach beyond the vulnerable component itself.
Exploitation status: As of October 20, 2026, CVE-2026-101529 is not listed in CISA's Known Exploited Vulnerabilities catalog. The sources cited below do not confirm active exploitation.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Enterprise Manager for Oracle Database
- Component: Data Guard Management
- Affected supported versions: 13.5 and 24.1
The NVD record does not list any CPEs yet.
Patch Status
The only reference for this CVE is Oracle's Critical Patch Update Advisory for October 2026. Administrators running Enterprise Manager for Oracle Database 13.5 or 24.1 should check that advisory for fix details and apply the relevant updates.
Because there is no KEV listing, no CISA-mandated required action or due date applies. Even so, the flaw is critical, needs only low privileges and can be reached remotely, so it should be patched first.