Oracle Enterprise Manager CVE-2026-46995

Exploitation requires network access to the Oracle Enterprise Manager Base Platform management console over HTTPS and a valid low-privileged OEM account (CVSS PR:L), targeting the Metadata Plugin component on affected versions 13.5 or 24.1; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the authentication requirement - this is not exploitable by an unauthenticated attacker per the CVSS vector, so realistic risk depends on how tightly low-tier console accounts and console network exposure are controlled. Deployments that expose the OMS console to broad or internet-facing networks, or that provision many low-privilege accounts, materially raise exploitability.

This is a genuine high priority within Oracle-heavy environments rather than a high-CVSS-but-low-impact issue: the CVSS vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity, low-privilege-only attack with no user interaction, and the outcome is a full platform 'takeover' (C:H/I:H/A:H). The main mitigating factor is PR:L - an attacker needs some existing authenticated OEM account, so this is not exploitable by a fully anonymous internet user against a hardened deployment. Countering signals from the intelligence sources are limited: no EPSS probability was supplied, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so real-world exploitation is currently unproven and likely to depend on an attacker first obtaining a foothold or a low-tier console credential. Note a minor inconsistency to verify with the vendor: the tags include 'Information Disclosure' while the description and CVSS assert full integrity and availability compromise ('takeover'), so treat this as a full-compromise flaw rather than a read-only disclosure. Because OEM often manages large fleets of databases, a takeover of the management plane is a high-leverage pivot even at moderate exploitation probability.

An attacker who holds or phishes a low-privilege Oracle Enterprise Manager console account connects to the OMS over HTTPS and sends crafted requests to the Metadata Plugin component to escalate to full control of the Base Platform. Having taken over OEM, the attacker can abuse its management reach over connected databases and hosts as a pivot for lateral movement. No public proof-of-concept is referenced in the provided data, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:L/UI:N) and Oracle's 'easily exploitable' characterization.