What is the CVSS score of CVE-2026-46996?

CVE-2026-46996 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46996?

A high-severity vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 enables attackers to manipulate critical operational data and extract sensitive information through the…

How to fix or mitigate CVE-2026-46996?

Within 24 hours, inventory all systems running Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 and isolate affected instances from untrusted networks. Within 7 days, implement network access controls restricting HTTPS connections to Enterprise Manager to trusted administrative networks and enable detailed audit logging of metadata access and modifications. Within 30 days, establish a vendor patch monitoring plan with Oracle support and implement a technical compensating control roadmap including read-only database snapshots, integrity monitoring, and continued network access restrictions.

Oracle Enterprise Manager CVE-2026-46996

EUVD-2026-46485 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-f4r6-7xxc-q4h3

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Remote HTTPS access with a valid low-privilege account (PR:L, AV:N, AC:L), no user interaction; high integrity and low confidentiality impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:18 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Data manipulation in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Metadata Plugin component) allows a low-privileged attacker with HTTPS network access to create, delete, or modify critical data and read a subset of data across the platform. Rated CVSS 3.1 7.1 by Oracle, the flaw is described as easily exploitable and tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's centralized management console for databases, middleware, and infrastructure. The affected component is the Metadata Plugin, which handles plugin metadata definitions consumed by the OEM management server. The vulnerability is exposed over the HTTPS management interface. No CWE was assigned by NVD/Oracle, so the precise weakness class is unconfirmed; the vendor 'Authentication Bypass' tag combined with the CVSS PR:L metric suggests an authorization/access-control weakness that lets an already-authenticated low-privilege account act beyond its intended scope rather than a fully pre-authentication bypass. The CPE cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform confirms the affected product across all listed builds of 13.5 and 24.1.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for Oracle Enterprise Manager Base Platform 13.5 and 24.1; the input does not include an exact patched build number, so treat patch status as 'Patch available per vendor advisory' and consult the CPU matrix for the precise version to install. As compensating controls until patching, restrict network reachability of the OEM HTTPS console to trusted management networks or a VPN/jump-host, tighten OEM account privileges and review low-privilege role grants that could reach the Metadata Plugin functionality, and enable auditing on metadata create/delete/modify operations to detect abuse - with the trade-off that network restrictions may disrupt legitimate remote administration and stricter role review can temporarily block operator workflows.