What is the CVSS score of CVE-2026-46872?

CVE-2026-46872 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46872?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical vulnerability (CVSS 9.0) allowing authenticated high-privileged attackers to modify or destroy data, deny service,…

How to fix or mitigate CVE-2026-46872?

Within 24 hours: Inventory all systems running Enterprise Manager Base Platform 13.5 and 24.1; audit and restrict high-privileged account access to essential personnel only; enable detailed logging for all management console authentication and administrative actions. Within 7 days: Implement network segmentation to restrict HTTPS access to the management platform to known administrative networks only; deploy multi-factor authentication for high-privileged accounts where technically feasible. Within 30 days: Establish a monitoring dashboard tracking Oracle CPU release schedules; develop and test a patching plan for immediate deployment when Oracle releases a fix; conduct a comprehensive risk assessment of dependent systems that may be affected by scope-change vulnerabilities.

Oracle Enterprise Manager CVE-2026-46872

EUVD-2026-37365 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Denial Of Service Oracle Oracle Enterprise Manager Base Platform

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable OMS HTTPS endpoint with low complexity but requiring high OEM admin privileges and no user interaction; scope change into managed Oracle products with limited confidentiality but high integrity and availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:35 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Install). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H).

AnalysisAI

Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authenticated, high-privileged attacker over HTTPS to modify or destroy critical data, read a subset of data, and trigger a complete denial of service, with scope change extending impact to additional products. Oracle rates the issue CVSS 3.1 9.0 and there is no public exploit identified at time of analysis, but the scope-change behavior and broad impact warrant prompt patching during the next Oracle CPU window.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's flagship management suite for monitoring, configuring, and orchestrating Oracle databases, middleware, engineered systems, and cloud workloads. The flaw resides in the Install component, which handles agent and plug-in deployment, target discovery, and inventory updates over the OEM management HTTPS channel; abuse here typically maps to deserialization, path/parameter handling, or privileged orchestration flaws that allow an OMS-authenticated administrator to step outside the management plane. Because OEM agents run with elevated privileges on managed hosts, a scope-change vulnerability in the Install path lets an OMS-side action affect targets it manages. No CWE was assigned by NVD, so the precise weakness class is not confirmed from input data.

RemediationAI

Apply the Oracle June 2026 Critical Patch Update bundle for Oracle Enterprise Manager Base Platform 13.5 and 24.1 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; exact patched build numbers are listed in that advisory and should be referenced directly rather than from third parties. Patch status from input data: patch available per vendor advisory, with the specific patched version not enumerated in the supplied intelligence. Until the OEM bundle is applied, compensating controls include tightly restricting OEM Super Administrator and EM_ALL_ADMINISTRATOR-class accounts, enforcing MFA on the OMS console and command-line (emcli) sessions, network-restricting the OMS HTTPS upload/console ports (typically 7799/7803 and 7802) to known management subnets, and auditing recent use of the Install/deployment workflows for suspicious agent or plug-in pushes; the trade-off of locking down emcli and Install endpoints is reduced ability to perform routine agent rollouts until the patch is staged.