EUVD-2026-46476
GHSA-fmhc-f6j2-m3q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege OEM account
-
DeliveryReach HTTPS management console
-
ExploitQuery Application SLM component
-
ExecutionBypass access control to other data
-
ImpactExfiltrate confidential data across managed products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle Enterprise Manager Base Platform web tier over HTTPS and a low-privileged authenticated account on OEM (CVSS PR:L), targeting the Application Service Level Management component of versions 13.5 or 24.1. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any holder of a low-tier OEM credential with console reachability can attempt it. Limiting factors: the attacker must first obtain valid low-privilege OEM access and be able to reach the management interface - note the vendor 'Authentication Bypass' tag conflicts with PR:L, so if a genuine pre-auth bypass exists the authentication prerequisite may not hold; verify with Oracle. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, score 7.7) describes an easily exploitable, network-reachable issue requiring only low privileges, no user interaction, and yielding total confidentiality loss with a scope change but no integrity or availability impact. No EPSS score, KEV entry, or POC was provided, so exploitation-probability signals are absent - the risk case rests on the vector and Oracle's 'easily exploitable' wording rather than observed activity. Note a conflict in the data: the 'Authentication Bypass' tag implies exploitation without valid credentials, yet the CVSS vector encodes PR:L (a low-privileged authenticated attacker); treat authentication as required per the authoritative vector and verify the bypass framing with Oracle. Because OEM often holds credentials and telemetry for an entire database estate, the scope change (impacting additional products) is the key risk amplifier and justifies prompt patching despite no known exploitation. |
| Exploit ScenarioDerived | A low-privileged user with a valid OEM account (or a compromised low-tier operator credential) sends crafted HTTPS requests to the Application Service Level Management component and retrieves confidential data belonging to other products managed through Enterprise Manager. Because of the scope change, the exposed data extends beyond OEM itself to connected targets. No public POC is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.
RemediationAI
Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Enterprise Manager Base Platform 13.5 and 24.1; Oracle CPUs are cumulative, so the current CPU bundle is the authoritative fix (no discrete standalone version number was supplied, so cite the CPU rather than an invented version). Until it can be applied, restrict network access to the OEM console and its HTTPS management endpoints to trusted administrative networks and jump hosts, tighten OEM role and privilege assignments so low-privilege accounts cannot reach the Application Service Level Management functionality, and monitor OEM access logs for anomalous data-access patterns - with the trade-off that network restrictions and role tightening may disrupt legitimate monitoring integrations and delegated administrators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Enterprise Manager (OEM) Base Platform is the central console used to monitor and administer Oracle databases, middleware, and infrastructure across an enterprise fleet. The flaw resides in the Application Service Level Management subcomponent, which handles service-level and performance monitoring exposed through the OEM web tier over HTTPS. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform. No CWE was assigned in the source data; however, the vendor tag 'Authentication Bypass' combined with the confidentiality-only impact and scope change points to an access-control / trust-boundary weakness that lets a low-privilege user reach data belonging to other components or targets managed by OEM.
Know when Oracle Enterprise Manager Base Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network HTTPS reach with low-privilege authenticated access (PR:L) and low complexity; total confidentiality loss with scope change to other products, no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain an information disclosure vulnerability allowing low-privileged users with network access to read all sensitive data stored in Enterprise Manager; no public exploit identified at time of analysis. The vulnerability creates material risk of unauthorized exposure of application credentials, database configurations, and operational intelligence across dependent systems, impacting any organization running affected Enterprise Manager versions. Immediate access controls are required to contain exposure until vendor patches become available.
No vendor-released patch identified at time of analysis. Implement network-based access controls restricting Enterprise Manager to administrative IP ranges; enable database activity monitoring on the backend database storing Enterprise Manager data; require VPN authentication for all access to Enterprise Manager interfaces; implement role-based access controls limiting low-privileged account permissions; conduct monthly audit reviews of all non-administrative database access to Enterprise Manager systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker v
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata P
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management compo
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network a
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker ov
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library comp
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Manageme
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authe
Exploit-DB