What is the CVSS score of CVE-2026-46987?

CVE-2026-46987 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46987?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain an information disclosure vulnerability allowing low-privileged users with network access to read all sensitive data stored in…

How to fix or mitigate CVE-2026-46987?

Within 24 hours: Identify all instances of Oracle Enterprise Manager versions 13.5 and 24.1 and restrict network access to trusted administrative IP ranges only; implement firewall rules limiting HTTPS access to known administrator sources. Within 7 days: Enable enhanced logging and monitoring of all Enterprise Manager database queries and API access; review access logs from the past 30 days for suspicious activity by non-administrative accounts; inventory all sensitive data stored in affected instances. Within 30 days: Contact Oracle Support for patch availability and timeline; plan upgrade or patch deployment for affected versions; implement network segmentation to further isolate Enterprise Manager from general network access.

Oracle Enterprise Manager CVE-2026-46987

EUVD-2026-46476 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-fmhc-f6j2-m3q9

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTPS reach with low-privilege authenticated access (PR:L) and low complexity; total confidentiality loss with scope change to other products, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:14 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is the central console used to monitor and administer Oracle databases, middleware, and infrastructure across an enterprise fleet. The flaw resides in the Application Service Level Management subcomponent, which handles service-level and performance monitoring exposed through the OEM web tier over HTTPS. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform. No CWE was assigned in the source data; however, the vendor tag 'Authentication Bypass' combined with the confidentiality-only impact and scope change points to an access-control / trust-boundary weakness that lets a low-privilege user reach data belonging to other components or targets managed by OEM.

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Enterprise Manager Base Platform 13.5 and 24.1; Oracle CPUs are cumulative, so the current CPU bundle is the authoritative fix (no discrete standalone version number was supplied, so cite the CPU rather than an invented version). Until it can be applied, restrict network access to the OEM console and its HTTPS management endpoints to trusted administrative networks and jump hosts, tighten OEM role and privilege assignments so low-privilege accounts cannot reach the Application Service Level Management functionality, and monitor OEM access logs for anomalous data-access patterns - with the trade-off that network restrictions and role tightening may disrupt legitimate monitoring integrations and delegated administrators.