Oracle Enterprise Manager CVE-2026-46857

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Enterprise Manager Base Platform 13.5 or 24.1 reachable over HTTP/HTTPS, per the CVSS AV:N/AC:L/PR:N/UI:N vector and Oracle's 'easily exploitable... unauthenticated attacker with network access via HTTP' wording. The only practical limiting factors are running a non-affected EM release line and network exposure of the Oracle Management Service tier; deployments where OMS console and agent ports are isolated to a management-only network materially reduce reachable attack surface, and no user interaction or privileged account on the target is required.

All available signals point to a high-priority issue: CVSS 3.1 AV:N/AC:L/PR:N/UI:N gives 9.8 with full C/I/A impact, and Oracle explicitly labels it 'easily exploitable' with 'takeover' as the outcome. EPSS, KEV, SSVC, and POC data are not provided in the input, so widespread or confirmed exploitation cannot be asserted; this is no public exploit identified at time of analysis. However, EM is a privileged management plane - compromise here typically yields credentialed pivot into every managed database and host - so even absent KEV listing the blast radius justifies treating this as critical. No conflicting signals were observed in the supplied data; the main unknowns are CWE classification and any vendor-published indicators of compromise.

An attacker with network reach to the OMS HTTPS port sends a crafted HTTP request to a vulnerable endpoint on Enterprise Manager 13.5 or 24.1 and gains administrative control of the management platform without authentication. From that foothold they pivot using OMS-stored credentials to managed Oracle databases, hosts, and middleware, extracting data and deploying persistence across the estate. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording and the AV:N/AC:L/PR:N/UI:N vector imply a straightforward single-request exploit once details surface.