Oracle Enterprise Manager CVE-2026-46989

Exploitation requires the attacker to have a valid low-privileged Oracle Enterprise Manager account (CVSS PR:L) and network/HTTPS reachability to the EM Base Platform UI Framework on version 13.5 or 24.1; no user interaction and no high privileges are needed (UI:N, AC:L). The limiting factors are: the attacker must already be authenticated at some privilege level (this is not a fully unauthenticated pre-auth exploit despite the 'Authentication Bypass' tag), and must be able to reach the EM console over the network - so environments that isolate EM to a restricted management network materially raise the bar. The scope change (S:C) means the impact can extend to other products EM manages, not just EM itself.

Signals are largely aligned toward high priority rather than inflated. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, base 9.1) shows a network-reachable, low-complexity attack needing only low privileges and no user interaction, with a scope change that pushes the score into critical territory despite only High confidentiality and Low integrity/availability impacts. The elevated score is driven mostly by the scope change and confidentiality loss, not by full CIA compromise - an attacker gains broad read access and partial write/DoS capability, not guaranteed total takeover. EPSS was not provided, so exploitation probability cannot be quantified; KEV status is not present (no active exploitation confirmed) and no POC is indicated, so real-world exploitation is currently unproven. Note a mild tension: Oracle tags this 'Authentication Bypass,' yet the vector requires PR:L (an authenticated low-privilege account), so this is more accurately an authorization/privilege-boundary bypass by an existing low-privileged user than a fully unauthenticated bypass - verify the exact pre-condition against Oracle's CPU advisory.

An attacker who holds or obtains a low-privilege EM account (or a foothold on the management network with such credentials) sends crafted HTTPS requests to the EM UI Framework to bypass authorization checks. With low attack complexity and no user interaction required, they harvest sensitive management data across the platform and issue limited write operations or trigger a partial denial of service against EM. No public POC is currently identified, but the network vector and AC:L make weaponization straightforward once details are understood.