What is the CVSS score of CVE-2026-46856?

CVE-2026-46856 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46856?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical remote takeover vulnerability requiring no authentication, enabling attackers to gain complete control of these core…

How to fix or mitigate CVE-2026-46856?

WITHIN 24 HOURS: Immediately identify all instances of Oracle Enterprise Manager Base Platform 13.5 and 24.1; restrict network access to administrative networks only and disable external HTTP access. Review system logs for exploitation indicators targeting the Metadata Plugin component. WITHIN 7 DAYS: Implement network segmentation isolating Enterprise Manager from untrusted networks; deploy WAF rules to block malformed requests to the Metadata Plugin component; enable comprehensive audit logging for all API calls. Establish daily patching readiness reviews with Oracle security advisories. WITHIN 30 DAYS: Monitor Oracle security advisories for patch availability; when released, prioritize emergency testing and deployment to patched versions; conduct post-incident forensic analysis of baseline access logs for evidence of prior exploitation.

Oracle Enterprise Manager CVE-2026-46856

EUVD-2026-37349 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform XSS

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

HTTP-reachable Metadata Plugin (AV:N/AC:L), no attacker auth (PR:N), requires victim operator interaction (UI:R), and compromise of OEM cascades into managed targets (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:43 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker over HTTP coerces a victim user into interacting with a crafted request targeting the Metadata Plugin component. The flaw is scope-changing and yields full confidentiality, integrity, and availability impact on the platform and potentially adjacent products. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager Base Platform is the central management framework Oracle ships for monitoring databases, middleware, engineered systems, and cloud workloads across an enterprise estate. The vulnerable surface is the Metadata Plugin component, which handles plugin/metadata processing within OEM; the CPE 'cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform' identifies the affected product line. No CWE is assigned, but the network/HTTP vector combined with required user interaction and a scope change is consistent with a client-coercion or injection-style flaw (e.g., reflected injection, deserialization, or SSRF-style coercion) that pivots from a user session into management-plane privileges.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update (Patch available per vendor advisory) by following the version-specific patch guidance at https://www.oracle.com/security-alerts/cspujun2026.html for OEM 13.5 and 24.1. Until patches are deployed, restrict the OEM console and Metadata Plugin endpoints to a management VLAN or VPN, place a reverse proxy/WAF in front of the OEM HTTP listener to filter unexpected metadata-related requests, and instruct OEM operators not to click externally-sourced OEM links - accepting that network restrictions may break federated/remote admin workflows and that WAF rules can produce false positives against legitimate plugin metadata traffic. Do not delay patching by relying on these compensating controls alone, since UI:R is trivially achievable via phishing.