Oracle Enterprise Manager CVE-2026-46868

Exploitation requires high-privileged authenticated access to the Oracle Enterprise Manager Base Platform (PR:H in the CVSS vector - typically an EM Super Administrator or equivalent role with rights into the Extensibility Framework), and network reachability to the OMS HTTPS endpoint (AV:N, AC:L, UI:N). Limiting factors: the target must be running EM Base Platform 13.5 or 24.1 specifically, no user interaction by another admin is needed, and the attack vector is the Extensibility Framework subsystem - so installations where administrative access is tightly restricted to a jump host or where the OMS console is not reachable from general user networks substantially constrain the realistic attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H produces a base score of 7.2 - high impact tempered by the PR:H requirement, meaning the attacker already needs administrative privileges on EM before the bug can be weaponised. There is no EPSS score, no CISA KEV listing, and no POC referenced in the supplied data, so realistic risk is moderate rather than urgent: this is a privilege-amplification/persistence concern for an already-trusted insider or a post-compromise pivot, not an internet-spray target. The 'Information Disclosure' tag in the source feed under-states the actual impact, which Oracle describes as full 'takeover' (C:H/I:H/A:H); defenders should treat this as a takeover bug, not just an info-leak. Key gap in available data: Oracle does not publish CWE, exact fix build numbers, or technical detail in advance of the CPU, so root cause is inferred only from the affected component name.

An attacker who has already obtained EM Super Administrator credentials - for example via password reuse, a phished DBA account, or lateral movement from a managed target - authenticates to the OMS console over HTTPS and abuses the Extensibility Framework to execute code or write trusted content into the management plane. This results in full takeover of the OMS, from which the attacker can push agent commands to every managed database and middleware target, exfiltrate stored credentials from the EM repository, and establish persistence across the fleet. No public exploit identified at time of analysis.