Oracle Enterprise Manager CVE-2026-46996

Exploitation requires network access to the Oracle Enterprise Manager Base Platform HTTPS management interface and a valid low-privilege account (CVSS PR:L), targeting the Metadata Plugin component on versions 13.5 or 24.1. What limits exploitation: the attacker must already hold some authenticated low-privilege access to OEM (not fully anonymous despite the 'Authentication Bypass' tag), the OEM console must be network-reachable to the attacker, and the target must be an unpatched 13.5 or 24.1 deployment; no user interaction and no high privileges are needed, and attack complexity is low.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates a remotely reachable, low-complexity attack that requires only low privileges and no user interaction, with high integrity impact, low confidentiality impact, and no availability impact - yielding 7.1 (High). Oracle explicitly calls it 'easily exploitable,' consistent with AC:L. No EPSS score was provided in the input, so exploitation probability cannot be quantified. It is not in CISA KEV and no POC was supplied, so there is no evidence of active exploitation; the real-world urgency rests on the high integrity impact against a privileged management platform. One tension to verify: the 'Authentication Bypass' tag implies no credentials needed, yet the CVSS vector requires PR:L (a valid low-privilege account) - treat this as authenticated privilege abuse unless Oracle's advisory states otherwise.

An attacker who has obtained or been granted a low-privilege OEM account authenticates to the Enterprise Manager HTTPS interface and sends crafted requests to the Metadata Plugin component. Because the attack is network-based and low-complexity with no user interaction, the attacker modifies or deletes critical management metadata and reads a subset of platform data, undermining the integrity of the systems OEM governs. No public proof-of-concept exploit was identified at time of analysis.