Oracle Enterprise Manager CVE-2026-46992

Exploitation requires network reachability to the Oracle Enterprise Manager Base Platform HTTPS interface and a valid low-privileged EM account (CVSS PR:L) - it is NOT unauthenticated. The vulnerable pathway is the Enterprise Config Management component of EM Base Platform versions 13.5 and 24.1. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker holds any authenticated EM foothold, no special non-default configuration is documented as required. The principal limiting factor is the authentication requirement: attackers without an existing EM account, or environments where the EM console is not network-reachable from attacker-controlled hosts, are not exposed to remote unauthenticated compromise.

This is a genuine high-priority patch candidate rather than a paper-high score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates network reachability, low attack complexity, no user interaction, and only low privileges required, with the stated outcome being complete takeover of the EM Base Platform. The main gating factor is PR:L - an attacker must already possess a low-privileged EM account, which limits purely external unauthenticated exploitation but is well within reach of insiders, compromised credentials, or environments where EM accounts are broadly provisioned. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation; this suggests risk is currently theoretical/latent rather than confirmed in the wild. Note a mild signal conflict: the vendor tag says 'Information Disclosure' while the CVSS and description describe full C/I/A takeover - treat the takeover framing as authoritative and the tag as an incomplete label.

An attacker who has obtained any low-privileged Oracle Enterprise Manager account - via phishing, credential reuse, or an over-provisioned internal user - connects to the EM console over HTTPS and sends a crafted request to the Enterprise Config Management component. With low attack complexity and no user interaction required, the attacker escalates to full control of the EM Base Platform, gaining the ability to read, alter, and disrupt management of all connected targets. No public POC was identified at the time of analysis.