What is the CVSS score of CVE-2026-46990?

CVE-2026-46990 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46990?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contains a high-severity vulnerability allowing unauthorized remote access to sensitive enterprise management data.

How to fix or mitigate CVE-2026-46990?

Within 24 hours: identify all systems running vulnerable versions 13.5 or 24.1 and assess network exposure; restrict inbound access to EM consoles to authorized networks only via firewall. Within 7 days: implement network segmentation to isolate EM platforms; disable the Enterprise Config Management component if not operationally required; establish monitoring for unauthorized configuration access. Within 30 days: monitor Oracle security advisories for patch availability; plan and execute upgrades to patched versions once released.

Oracle Enterprise Manager CVE-2026-46990

EUVD-2026-46479 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-f8pc-2rq4-j7qc

Denial Of Service Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Unauthenticated network HTTP access with low complexity and no user interaction, but impacts are limited to a subset of data and partial DoS, giving C:L/I:L/A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:16 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Unauthorized data access and partial denial of service in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the Enterprise Config Management component over HTTP and read, insert, update, or delete a subset of EM-accessible data. Oracle rates it CVSS 3.1 7.3 and describes it as 'easily exploitable' with no authentication or user interaction, so it is a high-priority patch for internet- or intranet-reachable EM consoles. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager (OEM) is Oracle's centralized management and monitoring platform for databases, middleware, and engineered systems; the Base Platform provides the OMS (Oracle Management Service) web tier and repository. The affected component, Enterprise Config Management, handles configuration collection, comparison, and compliance data for managed targets. The CPE cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform confirms the OMS/Base Platform tier is the target rather than an agent or plugin. No CWE was assigned by NVD, but the profile - unauthenticated HTTP access producing limited read plus write/delete and partial DoS across a single security scope (S:U) - is consistent with a broken-access-control or improper-authorization flaw in an exposed HTTP endpoint rather than full code execution.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update for Enterprise Manager as documented at https://www.oracle.com/security-alerts/cpujul2026.html (patch available per vendor advisory; no standalone fix version was published in the supplied data, so map your 13.5 or 24.1 release to the CPU-specified OMS system patch). Until patched, reduce exposure by restricting network access to the OMS HTTP/HTTPS console ports so only trusted administrative networks and jump hosts can reach it (place the console behind a VPN or IP allowlist), which limits the unauthenticated network vector at the cost of remote admin convenience; additionally front the console with a reverse proxy/WAF that filters requests to Enterprise Config Management endpoints, accepting the tuning overhead and potential for false positives. Do not expose the EM console directly to the internet.