What is the CVSS score of CVE-2026-46989?

CVE-2026-46989 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46989?

A critical vulnerability in Oracle Enterprise Manager Base Platform creates direct risk to your managed infrastructure assets through unauthorized data access and operational disruption.

How to fix or mitigate CVE-2026-46989?

Within 24 hours: Identify all systems running Oracle Enterprise Manager Base Platform, immediately restrict network access to the EM UI to essential administrators only, and engage Oracle Support for additional guidance. Within seven days: Deploy comprehensive audit logging and real-time alerting on all EM instances, implement network segmentation to isolate EM infrastructure from general network access, and review all EM administrative access logs for unauthorized activities. Within 30 days: Monitor Oracle security advisories and patch releases closely, evaluate any Oracle-provided interim workarounds, and prepare for prompt deployment of patches when available.

Oracle Enterprise Manager CVE-2026-46989

EUVD-2026-46478 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-q3f3-rh5m-pjjj

Denial Of Service Authentication Bypass Oracle Oracle Enterprise Manager Base Platform

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

vuln.today AI

9.1 CRITICAL

Network-reachable HTTPS UI with low complexity and an existing low-privilege account (PR:L), scope change from EM into managed products (S:C), high confidentiality but only partial integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:14 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).

AnalysisAI

Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.

Technical ContextAI

Oracle Enterprise Manager (EM) is Oracle's centralized management console for databases, middleware, engineered systems, and cloud/on-prem infrastructure; the Base Platform provides the core framework on which management packs and plug-ins run. The defect is in the UI Framework component, the web presentation and request-handling layer served over HTTPS. Oracle did not assign a CWE (CWE: N/A), but the 'Authentication Bypass' tag combined with a scope change (S:C) points to a flaw where the UI layer fails to properly enforce authorization boundaries, allowing an already-authenticated low-privilege user to reach data and functions belonging to other security contexts or downstream managed products. Because EM holds credentials and management authority over the estate it administers, a control-plane weakness here has outsized blast radius.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Enterprise Manager Base Platform 13.5 and 24.1; Oracle publishes exact patch/bundle numbers per version in that advisory (Patch available per vendor advisory - no standalone fix version was supplied in this data, so pull the precise patch ID from the CPU matrix). Until patched, reduce exposure by restricting network reach to the EM console - place it behind VPN/segmented management networks and block HTTPS access to the EM UI from untrusted zones (trade-off: may disrupt remote administrators). Tighten EM account provisioning and audit low-privilege accounts, since exploitation requires an authenticated low-privilege user; disable or remove unused/self-registration accounts to shrink the attacker pool. Enable and monitor EM access logs for anomalous cross-context data access. These are compensating controls only; the CPU patch is the definitive remediation.