What is the CVSS score of CVE-2026-46992?

CVE-2026-46992 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46992?

A high-severity vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows any authenticated low-privileged user to achieve complete platform takeover, threatening the…

How to fix or mitigate CVE-2026-46992?

Within 24 hours, inventory all Oracle EM deployments to identify affected versions (13.5 and 24.1) and determine the scope of low-privilege user accounts with HTTPS network access. Within 7 days, implement network-level restrictions limiting EM access to authorized administrative subnets only, enable comprehensive audit logging of all EM administrative operations, and evaluate whether the Enterprise Config Management component can be temporarily disabled if not essential. Within 30 days, contact Oracle for patch release timelines and develop a remediation plan prioritizing patching upon availability; if patching is delayed, plan controlled decommissioning or network isolation of affected EM instances.

Oracle Enterprise Manager CVE-2026-46992

EUVD-2026-46481 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-jrmc-p5mm-86gg

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable HTTPS console (AV:N/AC:L) exploitable by any authenticated low-privileged user (PR:L) with no interaction, yielding full platform takeover so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:16 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Enterprise Config Management component) allows an authenticated low-privileged attacker with network access over HTTPS to fully compromise the platform. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw requires only low privileges and no user interaction, making it readily exploitable once an attacker holds any valid EM account. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager Base Platform is Oracle's centralized management console for monitoring and administering databases, middleware, engineered systems, and cloud/on-prem infrastructure. The affected surface is the Enterprise Config Management component, which handles configuration collection, comparison, and management across managed targets. Oracle did not assign a specific CWE (CWE: N/A) and does not publicly disclose root-cause detail per its standard advisory practice, so the exact weakness class (e.g., injection, authorization bypass, or deserialization) cannot be confirmed from the provided data. The affected product is identified by CPE cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform, and the vendor tag 'Information Disclosure' hints at data exposure, though the CVSS records full C/I/A impact consistent with total platform takeover rather than disclosure alone.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html to Oracle Enterprise Manager Base Platform 13.5 and 24.1; no standalone fix version string was provided in the input, so obtain the exact patch identifier for your version directly from the CPU matrix. As Oracle discloses no configuration-level workaround, the primary compensating control is to tightly restrict who holds EM accounts and reduce the low-privilege user population that could satisfy the PR:L requirement, and to place the EM console behind network segmentation so its HTTPS interface is reachable only from trusted management networks rather than general corporate or internet-facing zones - the trade-off being reduced convenience for distributed administrators. Additionally, monitor Enterprise Config Management activity and EM authentication logs for anomalous low-privilege access pending patch deployment. Do not rely on these controls as a substitute for the CPU patch, since the vulnerability is exploitable by any authenticated low-privileged user.