EUVD-2026-46477
GHSA-9q7f-f85h-jj75
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high OEM privileges
-
DeliveryReach Connector Framework over HTTPS
-
ExploitSend crafted connector request
-
ExecutionTrigger platform compromise
-
ImpactTake over OEM Base Platform
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess high privileges on the Oracle Enterprise Manager Base Platform (CVSS PR:H) and network reachability to the OEM console over HTTPS; the vulnerable code path is in the Connector Framework component of versions 13.5 and 24.1. Limiting factors: no user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory high-privilege authentication (PR:H) sharply narrows the viable attacker set to those who can already authenticate as a privileged OEM user, and only OEM Base Platform 13.5 and 24.1 are stated to be affected. This is not remote-unauthenticated exploitation. |
| Impact | The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network reachable, low complexity, no user interaction, but requiring high privileges (PR:H), which is the single largest limiting factor. Full C/I/A impact indicates complete takeover once the privilege precondition is met. No EPSS score was provided in the input, and the CVE is not in CISA KEV, with no POC referenced - so exploitation signals point to low near-term real-world risk rather than mass exploitation. The realistic threat is a malicious or compromised privileged OEM user (or an attacker who has already obtained privileged OEM credentials) pivoting to total platform control; because OEM manages large fleets of databases and infrastructure, the blast radius of that takeover is high even though the entry barrier (PR:H) is significant. Note the apparent tension between the 'Information Disclosure' tag and the actual C:H/I:H/A:H takeover impact - treat this as a full-compromise issue, not merely disclosure. |
| Exploit ScenarioDerived | An attacker who already holds a high-privilege Oracle Enterprise Manager account - for example a rogue administrator or an outsider who phished/reused privileged OEM credentials - sends crafted HTTPS requests to the Connector Framework and abuses the flaw to seize full control of the OEM Base Platform. From there they can manipulate monitoring, integrity, and availability of every managed target. No public POC has been identified, and the attack requires the PR:H precondition to be satisfied first. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for Oracle Enterprise Manager Base Platform 13.5 and 24.1; Oracle CPUs bundle the exact recommended release update, so confirm and deploy the specific patched build for your version. Because exploitation requires high OEM privileges, effective compensating controls until patching are to tightly restrict and audit high-privilege OEM accounts, enforce least privilege on the management console, remove or constrain unused external connectors in the Connector Framework, place the OEM HTTPS console behind network segmentation so only trusted administrative networks can reach it, and enable monitoring/alerting on privileged connector configuration changes. The trade-off of restricting connectors is loss of automated ITSM/event integrations, and network segmentation may complicate legitimate remote administration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Enterprise Manager (OEM) Base Platform is Oracle's central management console for monitoring and administering Oracle databases, middleware, engineered systems, and cloud/on-prem infrastructure. The flaw resides in the Connector Framework, the subsystem OEM uses to integrate with external ticketing, event, and notification systems (e.g., ITSM connectors). The affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform. No CWE was assigned in the source data, so the precise weakness class (e.g., improper access control, injection, or deserialization within the connector processing path) cannot be confirmed; the CVSS profile (network HTTPS vector requiring high privileges leading to full compromise) is consistent with an authenticated-management-plane flaw that lets a privileged operator escalate to control of the OEM platform itself.
Know when Oracle Enterprise Manager Base Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network HTTPS reachability (AV:N) with low complexity but mandatory high OEM privileges (PR:H); successful attack yields full takeover, so C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical vulnerability in the Connector Framework component enabling complete system compromise, though no public exploit has been identified at time of analysis. The flaw affects confidentiality, integrity, and availability of the platform but requires existing high-privilege account access to exploit. With no vendor patch currently available, organizations must immediately restrict administrative access to minimize insider risk and prevent abuse by compromised high-privilege accounts.
No vendor-released patch identified at time of analysis. Implement these interim controls: restrict administrative console access via firewall rules and network access control lists, enforce multi-factor authentication for all high-privilege EM accounts, enable detailed audit logging of Connector Framework operations with automated alerting, maintain offline backups of critical EM configurations, and monitor all privileged account activity for lateral movement to managed systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker v
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata P
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management compo
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network a
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker ov
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library comp
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Manageme
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authe
Exploit-DB