Oracle Enterprise Manager CVE-2026-46867

Exploitation requires the attacker to already hold a high-privilege Oracle Enterprise Manager account (CVSS PR:H - typically an OEM administrator, SYSMAN-equivalent, or a role with Extensibility Framework rights) and network reachability to the OMS HTTPS endpoint; no user interaction is required and attack complexity is low once those preconditions are met. Exploitation is limited to deployments running Oracle Enterprise Manager Base Platform 13.5 or 24.1 with the Extensibility Framework component in use, and is bounded by whatever network segmentation the operator places around the OEM Console - installations that expose the OMS HTTPS port only to a hardened management VLAN materially reduce the realistic attack surface.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H signals fully network-reachable, low-complexity, no-user-interaction exploitation but requires high privileges, which materially limits the population of attackers - typically an OEM administrator or equivalent compromised account is needed before this bug is reachable. Total-takeover impact (C:H/I:H/A:H) is severe because Oracle Enterprise Manager generally holds elevated credentials for every database and middleware target it manages, so post-exploitation blast radius extends well beyond the OEM host itself. EPSS score, CISA KEV status, and public POC availability are not present in the provided intelligence, so probabilistic exploitation signals cannot be cross-referenced; treat this as a 'high-impact, privilege-gated' priority rather than an internet-facing zero-day, but accelerated patching is warranted given OEM's role as a credential hub.

An attacker who has already obtained credentials for a high-privilege Oracle Enterprise Manager account - for example through phishing of a DBA, password reuse, or a prior foothold on an admin workstation - connects to the OEM HTTPS console from the network and abuses the Extensibility Framework to execute a takeover action against the OMS, gaining full control of the management platform. Because OEM stores preferred credentials for every managed Oracle database and middleware target, the attacker can then pivot to those downstream systems. No public exploit identified at time of analysis.