Oracle Enterprise Manager CVE-2026-46853

Exploitation requires (1) network HTTP/HTTPS reach to the targeted OEM Base Platform 13.5 or 24.1 instance - typically a management network rather than the public internet - and (2) interaction (UI:R) from a different, already-authenticated OEM user (an administrator clicking a link, loading a page, or importing attacker-supplied metadata into the Metadata Plugin). The attacker themselves needs no credentials (PR:N). Limiting factors: OEM consoles are usually network-segmented, the victim must be a real OEM operator with an active session, and the attack surface is the Metadata Plugin specifically - instances that strictly control who can submit metadata reduce realistic exposure.

This is a genuine high-priority issue rather than an inflated CVSS number. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H pairs network reachability and no authentication with full confidentiality, integrity, and availability impact and a scope change, and Oracle itself describes it as 'easily exploitable' - the only meaningful brake is UI:R (a victim user must interact). No EPSS score, KEV listing, SSVC decision, or public POC is present in the provided data, so widespread automated exploitation cannot be asserted; however, OEM consoles are typically reachable only from internal management networks, which lowers internet-wide opportunism but raises insider/lateral-movement risk once a foothold exists. Tags include 'Information Disclosure' but the CVSS vector indicates full C/I/A impact and platform takeover - the tag understates the impact, and the CVSS scope-change description should be trusted over the tag.

An attacker hosts a malicious page or sends a crafted link to an OEM administrator; when the administrator - already authenticated to the OEM console - visits the link or loads attacker-supplied metadata, the Metadata Plugin processes the payload and performs privileged actions in the administrator's session, resulting in full takeover of the OEM platform and, via scope change, follow-on impact to the Oracle databases and middleware managed by that OEM instance. No public exploit identified at time of analysis, but the low complexity and unauthenticated network vector make POC development plausible once details are reverse-engineered from the patch.