CVE-2026-46998
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin). An unauthenticated attacker with network access via HTTPS can take over the platform, but requires user interaction.
Risk Assessment
The attack can lead to full takeover of Oracle Enterprise Manager, enabling data theft, modification, or disruption of infrastructure management services.
Recommendation
Apply Oracle patches for versions 13.5 and 24.1. Educate users about the risk of clicking suspicious links.
Other vulnerabilities in Oracle Enterprise Manager
See all- CVE-2026-47004High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Self Update Framework) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
- CVE-2026-46996High
Vulnerability in Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager, component Metadata Plugin. Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to create, delete, or modify critical data and read a subset of data.
- CVE-2026-46995High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
- CVE-2026-46987High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Application Service Level Mgmt). Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to critical data, with potential impact on additional products (scope change).
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).