What is the CVSS score of CVE-2026-46988?

CVE-2026-46988 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46988?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical vulnerability in the Connector Framework component enabling complete system compromise, though no public exploit has…

How to fix or mitigate CVE-2026-46988?

Within 24 hours: Identify all Oracle Enterprise Manager 13.5 and 24.1 instances, restrict network access to the Connector Framework component to essential personnel only, and audit the list of high-privilege account holders. Within 7 days: Enable comprehensive logging for all administrative activity within EM with real-time alerting on anomalies, implement network segmentation to isolate EM infrastructure from other critical systems, and contact Oracle Support to request patch availability timeline and interim hardening recommendations. Within 30 days: Deploy and test the security patch immediately upon vendor release, rotate credentials for all accounts holding administrative privileges, and conduct a forensic review of access logs for signs of unauthorized activity.

Oracle Enterprise Manager CVE-2026-46988

EUVD-2026-46477 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-9q7f-f85h-jj75

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTPS reachability (AV:N) with low complexity but mandatory high OEM privileges (PR:H); successful attack yields full takeover, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:14 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's central management console for monitoring and administering Oracle databases, middleware, engineered systems, and cloud/on-prem infrastructure. The flaw resides in the Connector Framework, the subsystem OEM uses to integrate with external ticketing, event, and notification systems (e.g., ITSM connectors). The affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform. No CWE was assigned in the source data, so the precise weakness class (e.g., improper access control, injection, or deserialization within the connector processing path) cannot be confirmed; the CVSS profile (network HTTPS vector requiring high privileges leading to full compromise) is consistent with an authenticated-management-plane flaw that lets a privileged operator escalate to control of the OEM platform itself.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for Oracle Enterprise Manager Base Platform 13.5 and 24.1; Oracle CPUs bundle the exact recommended release update, so confirm and deploy the specific patched build for your version. Because exploitation requires high OEM privileges, effective compensating controls until patching are to tightly restrict and audit high-privilege OEM accounts, enforce least privilege on the management console, remove or constrain unused external connectors in the Connector Framework, place the OEM HTTPS console behind network segmentation so only trusted administrative networks can reach it, and enable monitoring/alerting on privileged connector configuration changes. The trade-off of restricting connectors is loss of automated ITSM/event integrations, and network segmentation may complicate legitimate remote administration.