Oracle Enterprise Manager CVE-2026-46856

Exploitation requires (1) network HTTP reachability to an Oracle Enterprise Manager Base Platform 13.5 or 24.1 deployment's Metadata Plugin component, and (2) human interaction from a user other than the attacker - typically an authenticated OEM operator clicking a crafted link or visiting attacker-controlled content while logged in. No attacker authentication is needed (PR:N), and no non-default OEM configuration is called out by Oracle; limiting factors are the UI:R requirement and whether the OEM HTTP interface is reachable from the attacker's network position (deployments behind management VLANs / VPNs raise the bar).

All signals point to high real-world risk: CVSS 3.1 base score 9.6 with AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H means low-complexity, unauthenticated, network-borne exploitation with scope change and total CIA impact, limited only by required user interaction. EPSS data was not provided in the input, and the CVE is not in CISA KEV nor accompanied by a known POC, so exploitation is currently 'no public exploit identified at time of analysis.' Because OEM is a privileged management platform whose compromise typically cascades into databases and middleware (consistent with the stated scope change), defenders should treat this as a priority patch even without active exploitation evidence; the UI:R requirement is the main practical limiter and is easily satisfied by phishing OEM operators.

An attacker hosts or emails a crafted URL that points at an OEM Metadata Plugin endpoint; when an OEM administrator with an active session clicks it, the request is processed in the victim's context and pivots into full takeover of the OEM Base Platform, with the scope change extending impact to the databases and targets OEM manages. No public exploit is identified at time of analysis, but the AC:L/UI:R profile makes phishing-based delivery highly practical once technical details circulate.