CVE-2026-46987
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Manager Base Platform (component: Application Service Level Mgmt). Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to critical data, with potential impact on additional products (scope change).
Risk Assessment
Risk involves unauthorized access to sensitive data managed by the platform, potentially leading to information leakage and compliance violations.
Recommendation
Apply patches from Oracle for versions 13.5 and 24.1 and implement network segmentation to limit impact on other systems.
Other vulnerabilities in Oracle Enterprise Manager
See all- CVE-2026-47004High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Self Update Framework) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
- CVE-2026-46998High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin). An unauthenticated attacker with network access via HTTPS can take over the platform, but requires user interaction.
- CVE-2026-46996High
Vulnerability in Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager, component Metadata Plugin. Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to create, delete, or modify critical data and read a subset of data.
- CVE-2026-46995High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).