CVE-2010-3585: Oracle VM ovs-agent unspecified vulnerability allows authenticated compromise

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 2.0 score of 9.0 with complete impact and a very high EPSS percentile, though exploitation requires valid credentials and no KEV listing.

What it is

Oracle VM 2.2.1 contains an unspecified vulnerability in the OracleVM component related to ovs-agent. A remote authenticated user can fully affect confidentiality, integrity, and availability. A third-party researcher claims the issue involves exposure of unspecified functions via XML-RPC, but Oracle has not confirmed this.

Impact

An attacker with valid credentials gains full compromise of confidentiality, integrity, and availability on the affected Oracle VM host. This could allow control over virtual machine management functions or the host itself.

Attack surface

Reachable over the network (AV:N) with low attack complexity (AC:L), but requires authentication (Au:S). No user interaction is indicated. The specific interface is unknown, though the third-party claim points to XML-RPC functions.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged; EPSS is high at 0.52052 (98.9th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply the Oracle October 2010 Critical Patch Update for Oracle VM 2.2.1 or upgrade to a supported Oracle VM release.
• Restrict network access to ovs-agent and XML-RPC management interfaces to trusted administrative networks only.
• Enforce least privilege and strong authentication for Oracle VM management accounts; remove or disable unused accounts.
• Monitor for and block unauthorized XML-RPC calls to Oracle VM management endpoints.
• If patching is not immediately possible, isolate affected Oracle VM hosts from untrusted networks.

Detection

• Monitor ovs-agent and XML-RPC service logs for unexpected or malformed requests from authenticated users.
• Alert on anomalous management actions from Oracle VM accounts, such as unusual VM configuration changes or privilege use.
• Baseline normal ovs-agent network traffic and flag deviations, especially from non-administrative hosts.
• Audit authentication logs for successful logins followed by suspicious management operations on Oracle VM hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.