What is the CVSS score of CVE-2026-46864?

CVE-2026-46864 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46864?

Critical vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 enables authenticated users with SSH access to seize complete control of the platform, directly threatening…

How to fix or mitigate CVE-2026-46864?

Within 24 hours: Identify and inventory all systems running Enterprise Manager Base Platform 13.5 or 24.1; restrict SSH network access to these systems to trusted administrative networks only via firewall policy; enable detailed logging and alerting for authentication and administrative activities. Within 7 days: Implement or enforce multi-factor authentication on all SSH accounts accessing Enterprise Manager systems; conduct incident detection review for suspicious login attempts or privilege escalation on affected systems. Within 30 days: Monitor Oracle Critical Patch Update announcements for patch releases; develop and execute upgrade plan to transition affected systems to patched versions when available.

Oracle Enterprise Manager CVE-2026-46864

EUVD-2026-37357 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable SSH surface (AV:N), Oracle labels it easily exploitable (AC:L), a low-privileged credential is required (PR:L), no user interaction, and full takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:38 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via SSH to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Authenticated takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Agent Next Gen component, where a low-privileged attacker with SSH network access can fully compromise confidentiality, integrity, and availability. Oracle rates this 8.8 and describes it as easily exploitable, but no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The single source is Oracle's June 2026 Critical Patch Update advisory, which is the authoritative reference for affected versions and fixes.

Technical ContextAI

Oracle Enterprise Manager Base Platform is the core management framework for monitoring and administering Oracle databases, middleware, and engineered systems across enterprise estates. The vulnerable component, Agent Next Gen, is the management agent that runs on monitored hosts and communicates back to the OMS (Oracle Management Server), typically over secured channels. The advisory specifies SSH as the attack vector, indicating the weakness involves the agent's SSH-based remote command, file transfer, or management protocol surface rather than the HTTPS upload receiver. No CWE was assigned in the input, so the precise root-cause class (authentication bypass, command injection, privilege escalation in agent dispatch, etc.) cannot be determined from the available data, but the H/H/H impact combined with PR:L points to a privilege escalation or authorization flaw reachable by any holder of a low-privileged OEM/SSH credential.

RemediationAI

Apply the patches from Oracle's June 2026 Critical Patch Update for Oracle Enterprise Manager Base Platform 13.5 and 24.1 as published at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle CPU patches are the only vendor-released fix and exact patch identifiers should be retrieved from the CPU matrix in that advisory. Until patches are deployed, restrict network reachability to the Agent Next Gen SSH listener so it is only accessible from the OMS and authorized administrator jump hosts (firewall ACLs or host-based controls), rotate and tightly scope any low-privileged OEM/agent credentials that could satisfy the PR:L requirement, and monitor SSH authentication logs on agent hosts for anomalous logins from non-OMS sources. Note that locking down SSH to the agent may break ad-hoc administrative workflows that rely on direct agent access, so coordinate with DBA teams before tightening.