What is the CVSS score of CVE-2026-46991?

CVE-2026-46991 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Oracle Enterprise Manager CVE-2026-46991

EUVD-2026-46480 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-qf96-48m4-r3c4

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

Local logon required per description sets AV:L; low privilege sufficient per description sets PR:L; no availability impact stated, so A:N; scope unchanged as impact confined to OEM data.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:34 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Local access control weakness in Oracle Enterprise Manager Base Platform's Enterprise Config Management component allows low-privileged users with host logon rights to read a subset of OEM-accessible data and perform unauthorized inserts, updates, or deletes against accessible data records. Versions 13.5 and 24.1 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the local-only attack vector substantially constrains real-world exploitation to insider threats or previously compromised accounts.

Technical ContextAI

Oracle Enterprise Manager Base Platform is Oracle's centralized IT management suite for monitoring and administering Oracle databases, middleware, and infrastructure. The vulnerable component is Enterprise Config Management, which handles configuration discovery and lifecycle management within the platform. The CPE identifier cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform:*:*:*:*:*:*:*:* covers both affected releases (13.5 and 24.1). No CWE is formally assigned by the reporter; however, the intelligence tags flag 'Authentication Bypass', which in context of the CVSS vector (PR:L, not PR:N) likely describes an access control bypass within an authenticated session rather than a full pre-authentication bypass - a distinction worth clarifying with Oracle's advisory. The root cause class appears to be improper authorization enforcement on configuration management operations, where a low-privileged local user can exceed their intended read and write boundaries.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-46991 across Oracle Enterprise Manager Base Platform 13.5 and 24.1. An exact patched release version number was not stated in the available intelligence beyond the CPU advisory reference and should be confirmed directly with Oracle support before deployment. If immediate patching cannot be scheduled, restrict local system logon access to the OEM host to only explicitly authorized administrators and automation service accounts, eliminating the low-privileged user population that can reach the vulnerable component; note this may affect monitoring workflows and requires coordination with operations teams. Additionally, audit the Enterprise Config Management permissions model to enforce least-privilege separation, ensuring that standard users cannot invoke configuration write operations. Restrict network and console access to the OEM server using host-based firewall rules or privileged access workstation (PAW) controls to reduce the foothold attack surface that would enable an adversary to reach the local vector in the first place.