What is the CVSS score of CVE-2026-46985?

CVE-2026-46985 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Enterprise Manager CVE-2026-46985

EUVD-2026-46474 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-jjw5-pr5v-8cq2

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint with low confidentiality read impact only; no integrity, availability, or scope change applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:01 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform's Agent Next Gen component permits remote attackers to read a subset of platform-accessible data over HTTPS without credentials. Versions 13.5 and 24.1 are confirmed affected per Oracle's Critical Patch Update for July 2026. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the Authentication Bypass tag suggests a structural access control failure rather than a simple misconfiguration.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's flagship enterprise monitoring and lifecycle management platform, used to manage databases, middleware, and hosts at scale. The Agent Next Gen component is the next-generation monitoring agent responsible for collecting performance, configuration, and health metrics from managed targets and relaying them to the OEM management server over HTTPS. The CPE identifier cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform:*:*:*:*:*:*:*:* confirms Oracle's own product line. The advisory tag 'Authentication Bypass' combined with the CVSS vector (PR:N, AV:N) indicates that one or more HTTPS endpoints exposed by Agent Next Gen fail to enforce access controls prior to returning data, consistent with CWE-306 (Missing Authentication for Critical Function) or CWE-284 (Improper Access Control). No CWE was formally assigned in the advisory, so root cause class is inferred from available signals.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026 by consulting the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Specific patched build numbers for versions 13.5 and 24.1 must be confirmed directly from the Oracle CPU advisory, as exact fix version numbers were not independently detailed in the available data. As compensating controls prior to patching, restrict network access to the OEM Agent Next Gen HTTPS interface using host-based firewall rules or network ACLs, limiting inbound connections to authorized OEM management server IP ranges only - this eliminates the unauthenticated network path without affecting OEM monitoring functionality for legitimate users. Additionally, deploy monitoring or IDS signatures to detect anomalous unauthenticated HTTPS requests targeting OEM agent ports, which would provide early warning of exploitation attempts. No functional side effects are expected from network access restriction in properly segmented OEM deployments.