Oracle patches critical Enterprise Manager flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Oracle fixed eight vulnerabilities in Enterprise Manager, including two unauthenticated remote flaws rated up to CVSS 9.9, allowing code execution and data compromise.
NCSC-NL published an advisory summarizing Oracle's patches for multiple vulnerabilities in Oracle Enterprise Manager, affecting versions 13.5 and 24.1. The flaws span several components including Base Platform, Data Guard Management, Siebel, and Virtualization. Issue types include deserialization of untrusted data and incomplete validation of disallowed inputs, which can lead to unauthorized access to sensitive data, data modification, and loss of system availability and integrity. Some of the vulnerabilities allow arbitrary code execution.
Of the eight CVEs listed, two can be exploited remotely without authentication, making them the most urgent to address. The remaining vulnerabilities require low privileges or local access to exploit. CVSS scores range from 7.8 to 9.9, with CVE-2025-48734 (CVSS v4 9.3), CVE-2026-101528 and CVE-2026-101529 (both CVSS v3 9.9) representing the highest-severity issues.
No evidence of active exploitation in the wild is mentioned in the advisory. Oracle has released updates for Enterprise Manager and related components; defenders running affected versions should apply patches promptly, particularly given the presence of unauthenticated remote attack vectors against a management platform that typically has broad access across enterprise infrastructure.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0440.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,774 reports from 143 sources, 495 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs