CVE-2026-46995
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
Risk Assessment
Risk of full takeover of the management platform, potentially leading to data theft from monitored systems or denial of service.
Recommendation
Apply the Oracle patch for versions 13.5 and 24.1. Restrict access to the Enterprise Manager console.
Other vulnerabilities in Oracle Enterprise Manager
See all- CVE-2026-47004High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Self Update Framework) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
- CVE-2026-46998High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin). An unauthenticated attacker with network access via HTTPS can take over the platform, but requires user interaction.
- CVE-2026-46996High
Vulnerability in Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager, component Metadata Plugin. Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to create, delete, or modify critical data and read a subset of data.
- CVE-2026-46987High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Application Service Level Mgmt). Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to critical data, with potential impact on additional products (scope change).
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).