What is the CVSS score of CVE-2026-46865?

CVE-2026-46865 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46865?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a privilege escalation vulnerability that allows high-privilege local users to achieve complete platform compromise with scope…

How to fix or mitigate CVE-2026-46865?

24 hours: Audit all systems running Oracle EM 13.5 and 24.1; immediately restrict local logon and administrative access to EM hosts to named, approved personnel only. 7 days: Deploy privileged access management (PAM) controls for all EM administrative accounts; enable enhanced logging and monitoring of host access, sudo usage, and administrative actions. 30 days: Monitor Oracle security advisories for patch release; establish upgrade plan to patched version when available; consider temporary isolation of non-production EM instances if risk tolerance is low.

Oracle Enterprise Manager CVE-2026-46865

EUVD-2026-37358 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Requires local logon to the EM host with high host privileges (AV:L, PR:H, AC:L, UI:N); full EM takeover plus scope change to managed Oracle targets justifies S:C and C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:37 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privileged local compromise in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Extensibility Framework component) allows a high-privileged attacker with logon access to the host running EM to fully take over the platform, with scope change extending impact to additional managed Oracle products. CVSS 3.1 base score is 8.2 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. The scope-changing nature makes this a notable lateral-movement primitive in Oracle estates even though prerequisites are non-trivial.

Technical ContextAI

Oracle Enterprise Manager (EM) Base Platform is Oracle's centralized management console for databases, middleware, engineered systems, and cloud workloads; the Extensibility Framework is the subsystem that lets administrators load plug-ins and metadata extensions that drive EM target discovery, monitoring, and job execution. A defect in this framework lets a logged-on, high-privileged user pivot from the EM host into the platform itself and, because of the CVSS scope change (S:C), reach security authorities beyond the EM Base Platform - typically the managed targets EM administers. No CWE was supplied by Oracle, which is consistent with their disclosure practice of withholding root-cause detail; the affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform covering versions 13.5 and 24.1.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update (CPU Jun 2026) for Enterprise Manager Base Platform 13.5 and 24.1, following the patch matrix at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle does not publish a discrete fix-version string for EM in CPU advisories, so the patch is identified by the CPU release and component identifier rather than a semver. Until patches are staged, tightly restrict OS logon to the EM management host to a minimal set of EM administrators, audit and rotate sudoers and the oracle/emagent service accounts, and review host-level access logs for unexpected interactive sessions - these controls directly address the AV:L/PR:H precondition but do not stop a legitimately privileged operator from exploiting the issue. Given the scope change, also confirm that EM-stored named credentials for managed databases and middleware are rotatable and consider pre-staging credential rotation procedures in case post-patch forensics indicate prior misuse.