CVE-2026-46996
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager, component Metadata Plugin. Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to create, delete, or modify critical data and read a subset of data.
Risk Assessment
Risk of integrity and confidentiality breach of IT infrastructure management data, potentially leading to unauthorized configuration changes and information leakage.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for Enterprise Manager.
Other vulnerabilities in Oracle Enterprise Manager
See all- CVE-2026-47004High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Self Update Framework) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
- CVE-2026-46998High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin). An unauthenticated attacker with network access via HTTPS can take over the platform, but requires user interaction.
- CVE-2026-46995High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
- CVE-2026-46987High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Application Service Level Mgmt). Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to critical data, with potential impact on additional products (scope change).
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).