Oracle Enterprise Manager CVE-2026-46854

Exploitation requires HTTP/HTTPS reachability to the Oracle Enterprise Manager Base Platform console on a vulnerable 13.5 or 24.1 deployment and a valid low-privilege OEM account (CVSS PR:L), with no user interaction and low attack complexity. Limiting factors are that the OEM management interface is typically not exposed to the public internet and that the attacker must already hold or obtain authenticated credentials to OEM itself; deployments that strictly segment the OEM console to an administrative VLAN and tightly govern low-privilege account issuance materially reduce real-world exposure.

Signals are strongly aligned toward priority remediation: CVSS 3.1 is 9.9 with AV:N, AC:L, PR:L, UI:N, S:C, C:H/I:H/A:H - meaning a single low-privileged OEM account is sufficient for remote, no-interaction exploitation with full impact and cross-component blast radius. Vendor reporting is by Oracle itself via the June 2026 Critical Patch Update advisory, but there is no CISA KEV listing, no published EPSS score in the supplied data, and no public POC identified, so widespread opportunistic exploitation is not yet evidenced. The combination of low privilege requirement and scope change is notable because OEM commonly federates credentials into managed databases, so even absent public exploitation the realistic worst-case is enterprise-wide Oracle compromise; CWE is N/A in the input, which limits root-cause certainty and should be confirmed against Oracle's CPU notes.

An attacker who has obtained or been issued a low-privilege OEM user account - for example via phishing of an operator, reuse of leaked credentials, or an over-permissive self-service role - sends crafted HTTP requests to Target Management endpoints from the corporate network. The scope-changed flaw lets those requests act beyond the attacker's role, taking over the OEM platform and, by pivoting through stored named credentials, reaching managed Oracle databases and middleware; no public exploit identified at time of analysis, but the low complexity makes weaponization straightforward once details emerge.