Oracle Enterprise Manager CVE-2026-46991

Exploitation requires an existing low-privileged account with local logon access to the host where Oracle Enterprise Manager Base Platform is executing - a standard user-level account suffices per the CVSS PR:L metric; no administrative or elevated privileges are needed. The Enterprise Config Management component must be active in the deployment, which is a default capability of the Base Platform product. Exploitation is inherently limited to users or processes that can log on locally to the OEM server; remote-only accounts cannot directly trigger this flaw without a separate initial access vector. The 'Authentication Bypass' intelligence tag may indicate that certain authorization checks within Enterprise Config Management can be circumvented post-authentication rather than before it - consistent with the PR:L, not PR:N, CVSS assignment. No user interaction is required once local access is established (UI:N). Key limiting factor: the local attack vector substantially narrows the realistic attacker pool to insiders, compromised service accounts, or lateral-movement scenarios.

The CVSS 3.1 score of 4.4 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N reflects a constrained but reliably exploitable flaw. The local attack vector (AV:L) is the dominant limiting factor - the attacker must already hold a valid account with logon access to the OEM host, restricting the threat population to insiders, privileged service accounts, or actors who have already achieved initial access through a separate vector. Attack complexity is low (AC:L), meaning no special conditions or race conditions are required once access is established. The impact is bounded: confidentiality and integrity effects are both low, and availability is unaffected (A:N), meaning this does not present a path to data destruction or denial of service. No EPSS probability was supplied in the intelligence feed; however, the local-only vector, absence of CISA KEV listing, and absence of known public exploit code collectively suggest this is a low exploitation priority in practice. The 'Authentication Bypass' tag conflicts slightly with the PR:L CVSS metric - a true pre-auth bypass would carry PR:N; this inconsistency should be verified against Oracle's advisory before drawing conclusions about the authentication requirement. This vulnerability is appropriately treated as a scheduled-maintenance patch item rather than an emergency response.

An insider with a standard local user account on the Oracle Enterprise Manager host - or an external attacker who has already pivoted to that host via an unrelated vulnerability - interacts with the Enterprise Config Management component and issues requests that bypass the intended access controls, retrieving configuration data they are not authorized to view and writing unauthorized changes to OEM-managed configuration records. No public proof-of-concept exploit code has been identified at time of analysis. Because the attack vector is strictly local (AV:L), exploitation cannot be performed remotely without a prior foothold on the target host.