CVE-2026-47002
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Manager Base Platform (component: UI Framework). Affects versions 13.5 and 24.1. Easily exploitable by an unauthenticated attacker with network access via HTTPS, requires user interaction. Successful attack may impact additional products (scope change) and allows unauthorized modification and read access to data.
Risk Assessment
Risk includes confidentiality and integrity impacts on Oracle Enterprise Manager data and potential impact on other systems, leading to broader compromise.
Recommendation
Apply Oracle patches for versions 13.5 and 24.1 and restrict access to the UI Framework interface.
Other vulnerabilities in Oracle Enterprise Manager Base Platform
See all- CVE-2026-46994Critical
Vulnerability in Oracle Enterprise Manager Base Platform (Agent Next Gen component) allows an unauthenticated attacker via HTTPS to fully compromise the system.
- CVE-2026-46989Critical
Vulnerability in Oracle Enterprise Manager Base Platform (component: UI Framework) versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can compromise the platform, gaining unauthorized access to critical data, as well as update, insert, or delete access, and cause partial denial of service. CVSS 9.1.
- CVE-2026-46872Critical
Vulnerability in the Oracle Enterprise Manager Base Platform product allows a high privileged attacker with network access via HTTPS to compromise the system. Attacks may significantly impact additional products, leading to unauthorized access to critical data and the ability to cause system crashes.
- CVE-2026-46854Critical
A vulnerability in the Oracle Enterprise Manager Base Platform product allows a low privileged attacker with network access via HTTP to compromise the platform. Affects versions 13.5 and 24.1, and attacks may significantly impact additional products.
- CVE-2026-70684High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Agent Next Gen) affects versions 13.5 and 24.1. It is difficult to exploit but allows an unauthenticated attacker via HTTP to take over the platform. Successful attacks result in full takeover.
- CVE-2026-61300High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Agent Next Gen) affects versions 13.5 and 24.1. A low-privileged attacker with local access to the infrastructure can take over the platform.
- CVE-2026-61298Medium
Vulnerability in Oracle Enterprise Manager Base Platform (component: Enterprise Manager Install) affects versions 13.5 and 24.1. It is difficult to exploit, requires logon to the infrastructure, and a low-privileged attacker can gain unauthorized access to critical data or all data of the platform. Attacks may impact additional products (scope change).
- CVE-2026-61286High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Event Management) affects versions 13.5 and 24.1. An unauthenticated attacker with network access via HTTP can perform unauthorized modifications to critical data, gain partial access to data, and cause partial denial of service. CVSS score is 8.6.
- CVE-2026-61284High
Vulnerability in Oracle Enterprise Manager Base Platform (component: Application Config Console) affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTP can fully compromise the system. CVSS score is 8.8.
- CVE-2026-47006High
Vulnerability in Oracle Enterprise Manager Base Platform (Self Update Framework component) allows a high-privileged attacker via HTTPS to take over the platform.
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).