Oracle Enterprise Manager CVE-2026-46852

The attacker must have network reachability to the Oracle Enterprise Manager Base Platform console over HTTPS and must hold a low-privileged OEM user account (PR:L) - anonymous unauthenticated access is not sufficient. Only OEM Base Platform versions 13.5 and 24.1 are confirmed affected, and exploitation specifically requires interaction with the Metadata Plugin component. No user interaction is required (UI:N) and attack complexity is low (AC:L). The realistic limit on exploitation is the requirement to first obtain valid OEM credentials, which is a soft control in environments that hand out operator accounts liberally.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields a 9.9 score driven primarily by the scope change - successful exploitation does not stop at OEM itself but extends to the database, middleware, and infrastructure targets OEM manages, which in most enterprises means crown-jewel systems. Attack complexity is low and only a low-privileged OEM account is required, which is significant because OEM environments routinely provision read-only or operator accounts to DBAs, SREs, and auditors, making the prerequisite realistic. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided intelligence; however, the absence of public exploit code should not lower priority given OEM's role as a high-value target and the historical pattern of Oracle CPU vulnerabilities being reverse-engineered from patches. Note that the vendor's 'Information Disclosure' tag conflicts with the description's 'takeover' impact and C:H/I:H/A:H - the CVSS vector and description should be treated as authoritative over the tag.

An attacker who has obtained or been granted a low-privileged OEM account - for example a junior DBA, contractor, or compromised service account - connects to the OEM console over HTTPS and sends crafted requests to the Metadata Plugin component to escalate privileges within OEM and then pivot, via OEM's trust relationships and stored credentials, to managed Oracle databases and middleware. No user interaction is required and attack complexity is low. No public exploit identified at time of analysis, but Oracle CPU patches are routinely reverse-engineered, so post-patch exposure windows are realistic.