# Oracle patches critical Enterprise Manager flaws

Published: 2026-10-21 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/857e9a94-cc0c-5a9b-ba46-1b0310ee500c/oracle-patches-critical-enterprise-manager-flaws

> Oracle fixed eight vulnerabilities in Enterprise Manager, including two unauthenticated remote flaws rated up to CVSS 9.9, allowing code execution and data compromise.

NCSC-NL published an advisory summarizing Oracle's patches for multiple vulnerabilities in Oracle Enterprise Manager, affecting versions 13.5 and 24.1. The flaws span several components including Base Platform, Data Guard Management, Siebel, and Virtualization. Issue types include deserialization of untrusted data and incomplete validation of disallowed inputs, which can lead to unauthorized access to sensitive data, data modification, and loss of system availability and integrity. Some of the vulnerabilities allow arbitrary code execution.

Of the eight CVEs listed, two can be exploited remotely without authentication, making them the most urgent to address. The remaining vulnerabilities require low privileges or local access to exploit. CVSS scores range from 7.8 to 9.9, with CVE-2025-48734 (CVSS v4 9.3), CVE-2026-101528 and CVE-2026-101529 (both CVSS v3 9.9) representing the highest-severity issues.

No evidence of active exploitation in the wild is mentioned in the advisory. Oracle has released updates for Enterprise Manager and related components; defenders running affected versions should apply patches promptly, particularly given the presence of unauthenticated remote attack vectors against a management platform that typically has broad access across enterprise infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2025-48734, CVE-2026-101518, CVE-2026-101525, CVE-2026-101526, CVE-2026-101527, CVE-2026-101528, CVE-2026-101529, CVE-2026-54512

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0440.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/857e9a94-cc0c-5a9b-ba46-1b0310ee500c/oracle-patches-critical-enterprise-manager-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup