What is the CVSS score of CVE-2026-46995?

CVE-2026-46995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46995?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical vulnerability (CVE-2026-46995) allowing low-privileged authenticated users to achieve complete platform compromise…

How to fix or mitigate CVE-2026-46995?

Within 24 hours, identify all instances of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 in your environment and implement network access restrictions to authorized administrators only; immediately audit and revoke unnecessary low-privilege service accounts that could be used for exploitation. Within 7 days, deploy network segmentation to isolate affected EM Platform systems, configure comprehensive logging and alerting for authentication anomalies and suspicious API activity, and contact Oracle support to determine whether interim updates or compensating guidance are available. Within 30 days, develop a migration or upgrade plan; if Oracle releases a patched version, prioritize testing in non-production environments and coordinate controlled deployment across your fleet.

Oracle Enterprise Manager CVE-2026-46995

EUVD-2026-46484 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-jwgh-cj37-3q4c

Privilege Escalation Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable HTTPS console with low-complexity attack, requiring an existing low-privilege account (PR:L) and no user interaction, yielding full platform takeover (C/I/A High).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:17 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a low-privileged, authenticated attacker with network access over HTTPS to fully compromise the platform via the Metadata Plugin component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8, the flaw is described by Oracle as 'easily exploitable' and requires only an existing low-privilege account and no user interaction. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's centralized IT management console for monitoring and administering Oracle databases, middleware, engineered systems, and hosts, typically deployed as an on-premises management server (OMS) accessed via an HTTPS web console. The affected component is the Metadata Plugin, part of the extensible plugin architecture OEM uses to describe and process managed-target metadata. Oracle did not assign a CWE (CWE: N/A) and did not publish root-cause internals per its usual Critical Patch Update disclosure practice, so the specific weakness class (e.g., access control, injection, or deserialization in the metadata-handling path) cannot be confirmed from the provided data. The CPE cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform identifies the Base Platform application itself as the affected artifact.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html, which is the authoritative source for the exact patch/bundle numbers for OEM 13.5 and 24.1 (Patch available per vendor advisory; the input does not include a discrete fix version string, so obtain the specific system/bundle patch IDs from the CPU matrix). Because exploitation requires an authenticated low-privileged account, compensating controls until patching include restricting network access to the OMS HTTPS console to trusted management networks or a jump host rather than exposing it broadly, auditing and pruning low-privilege OEM accounts and enforcing strong authentication and MFA on the console, and closely monitoring the Metadata Plugin and console access logs for anomalous activity; the trade-off of network restriction is reduced administrative convenience for distributed operators, and account pruning may interrupt legitimate limited-scope users. Do not treat these controls as a substitute for the CPU patch, since they only reduce reachability and do not remove the underlying flaw.