What is the CVSS score of CVE-2026-46852?

CVE-2026-46852 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46852?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical privilege escalation vulnerability in the Metadata Plugin that allows low-privileged attackers to achieve complete…

How to fix or mitigate CVE-2026-46852?

Within 24 hours: Identify all systems running Enterprise Manager 13.5 or 24.1; restrict network access to the platform to essential administrators only and require VPN/jump-host access. Within 7 days: Contact Oracle Support to confirm patch availability and timeline; implement network segmentation isolating Enterprise Manager from production systems; enable audit logging on Metadata Plugin access. Within 30 days: Deploy any released patch immediately upon availability; if no patch emerges, execute migration plan to supported versions or alternative management platforms.

Oracle Enterprise Manager CVE-2026-46852

EUVD-2026-37345 CRITICAL

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform Privilege Escalation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTPS reach with a low-privileged OEM account, no user interaction, and a scope change into managed targets justify AV:N/AC:L/PR:L/UI:N/S:C with C:H/I:H/A:H for takeover.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:45 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata Plugin component, allowing a low-privileged remote attacker over HTTPS to fully compromise the platform with a scope change that impacts additional products. The CVSS 3.1 base score of 9.9 reflects the broad confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's centralized management framework for Oracle databases, middleware, engineered systems, and cloud workloads, providing monitoring, configuration, patching, and lifecycle automation. The Metadata Plugin component is part of OEM's extensibility model, used to register and process plugin metadata describing target types, jobs, and management capabilities. CWE data is not provided, but the combination of network-reachable HTTPS attack vector, low privilege requirement, and scope change strongly suggests a server-side processing flaw (such as input handling, deserialization, or authorization bypass) in the Metadata Plugin pipeline that allows an authenticated low-privilege OEM user to escalate beyond OEM's trust boundary to managed targets.

RemediationAI

Apply the patches delivered in Oracle's June 2026 Critical Patch Update (Patch available per vendor advisory) by following the bulletin at https://www.oracle.com/security-alerts/cspujun2026.html for OEM 13.5 and 24.1 - Oracle does not publish exact post-patch build numbers in advance of CPU consumption, so confirm the specific OEM bundle patch ID against your version in My Oracle Support. Until patching is complete, restrict network reachability of the OEM console and EM Agent communication ports (typically 7799/7802) to a management VLAN or jump-host segment to remove broad HTTPS exposure, and audit/remove unnecessary low-privilege OEM accounts since PR:L is sufficient for exploitation. Avoid disabling the Metadata Plugin component as a workaround because it is a core extensibility subsystem and breaking it will impair plugin deployment, target discovery, and monitoring; segmentation and account hardening are lower-impact compensating controls.