What is the CVSS score of CVE-2026-46984?

CVE-2026-46984 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Enterprise Manager CVE-2026-46984

EUVD-2026-46473 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-8c4f-j997-75rw

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no interaction needed; impact is confidentiality-only, partial, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:01 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) exposes a subset of platform data to remote attackers via HTTPS. The vulnerability resides in the Agent Next Gen component and is classified as an authentication bypass, enabling network-accessible exploitation without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, its low complexity and zero-authentication requirement make it straightforwardly exploitable by any internet-accessible instance.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's centralized IT management and monitoring solution used to administer Oracle databases, middleware, and cloud infrastructure. The affected component, Agent Next Gen, is the next-generation management agent responsible for collecting monitoring data and relaying it to the OEM management server. The vulnerability is tagged as an Authentication Bypass, meaning the Agent Next Gen component exposes data or an endpoint over HTTPS that should require authentication but does not enforce it. The CWE classification was not provided by the reporter; however, given the authentication bypass tag and the CVSS PR:N indicator, the root cause class is most consistent with CWE-306 (Missing Authentication for Critical Function) or CWE-284 (Improper Access Control). Affected versions are confirmed as 13.5 and 24.1 per both Oracle's advisory and EUVD-2026-46473.

RemediationAI

Apply the patches provided in the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patched version numbers in CVE advisories; consult the CPU documentation and My Oracle Support (MOS) for the specific patch set identifiers for OEM Base Platform 13.5 and 24.1. As a compensating control pending patch application, restrict network access to the Agent Next Gen HTTPS endpoint using firewall rules or network segmentation so that only authorized OEM management servers and administrators can reach it - this directly limits the unauthenticated attacker's ability to reach the vulnerable endpoint. Do not expose OEM infrastructure (management server or agents) directly to untrusted networks. Note that network restriction does not fix the underlying authentication bypass and must be replaced by the vendor patch.