What is the CVSS score of CVE-2026-46994?

CVE-2026-46994 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46994?

Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) contains a critical vulnerability (CVE-2026-46994) enabling complete remote takeover of the management platform.

How to fix or mitigate CVE-2026-46994?

Within 24 hours, inventory all Oracle Enterprise Manager deployments specifically targeting versions 13.5 and 24.1, and determine if the Agent Next Gen component is deployed and exposed. Within 7 days, immediately restrict network access to the Agent Next Gen component over HTTPS (block all untrusted inbound connections), disable remote management features if operationally feasible, and implement enhanced real-time logging of authentication attempts and configuration changes. Within 30 days, continuously monitor Oracle Critical Patch Update advisories for a vendor-released patch and develop an emergency patching plan for rapid deployment once available.

Oracle Enterprise Manager CVE-2026-46994

EUVD-2026-46483 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-v9xh-4p5x-668r

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated, easily exploitable network HTTPS access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:17 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Enterprise Manager (OEM) is Oracle's centralized management console used to monitor and administer Oracle databases, middleware, engineered systems, and infrastructure across an enterprise. The affected component, 'Agent Next Gen,' is the modernized management agent framework through which the OEM management server communicates with monitored targets over HTTPS. Because OEM agents run with broad operational privileges and the console holds credentials and control over managed estate, a flaw in the agent-facing HTTPS interface that permits unauthenticated compromise is severe. Oracle did not assign a CWE (listed as N/A), and the advisory does not disclose the root-cause class; the 'Information Disclosure' tag plus the C:H/I:H/A:H vector suggests the flaw may enable deserialization, authentication bypass, or injection leading to remote takeover, but the exact weakness is not specified in the available data.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Enterprise Manager Base Platform 13.5 and 24.1 as the primary remediation; the specific patched version numbers are enumerated in that advisory (patch available per vendor advisory, exact build not restated in this input, so do not assume a version). Because Oracle CPU patches must be applied promptly and OEM is a high-value control plane, prioritize this in the current patch cycle. As compensating controls until patching, restrict network access to the OEM management server and agent HTTPS ports (default 4903/4900 and console 7803/7802) so only trusted management subnets and known agents can reach them, place the OEM tier behind firewall/allowlist rules and off any internet-facing path, and monitor the agent HTTPS endpoints for anomalous connections; the trade-off is that overly tight allowlisting can disrupt legitimate agent-to-OMS communication and must be validated against your agent inventory.