CVE-2026-83068

CVE-2026-83068 is a high-severity (CVSS 7.7) information disclosure vulnerability in the Core component of Oracle Enterprise Manager for Oracle Database, affecting version 24.1. A low-privileged attacker with network access to the OEM console over HTTP can exploit the flaw easily (low attack complexity, no user interaction) to read critical data, including complete access to all data reachable through Oracle Enterprise Manager for Oracle Database. Because the vulnerability exhibits a scope change, successful attacks can also significantly impact products beyond the OEM for Oracle Database boundary. The issue affects organizations running OEM 24.1 that expose the console to networks reachable by low-privilege or authenticated users. There is no evidence of exploitation in the wild and no public proof-of-concept at this time.

What to do: Apply the Oracle Critical Patch Update that remedies CVE-2026-83068 to your Oracle Enterprise Manager for Oracle Database 24.1 deployment as soon as it is available for your environment. Restrict network access to the OEM console (HTTP/HTTPS management ports) so only trusted admin subnets can reach it, and audit low-privileged OEM accounts for unusual data access. Because of the scope change, also review downstream Oracle Database and managed-target credentials accessible via OEM for signs of unauthorized reads.