What is the CVSS score of CVE-2026-46997?

CVE-2026-46997 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Oracle Enterprise Manager CVE-2026-46997

EUVD-2026-46486 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-7mg8-x2p5-qfm3

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible via HTTPS with low complexity; low-privilege credential required per 'Authentication Bypass' context; no confidentiality or availability impact matches description of data modification only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:35 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Unauthorized data manipulation in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is achievable by any low-privileged user with network HTTPS access, specifically through the Metadata Plugin component. The flaw - tagged as an authentication bypass - enables arbitrary creation, deletion, or modification of critical OEM metadata, potentially affecting all data accessible within the platform. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) make this a credible insider or compromised-credential threat in any organization with OEM deployed.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's flagship enterprise management solution for administering Oracle Databases, Middleware, and application stacks at scale. The vulnerable component is the Metadata Plugin, which manages metadata operations - likely including CRUD actions on target definitions, monitoring configurations, and administrative records within the OEM repository. The CPE string cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform:*:*:*:*:*:*:*:* identifies the platform broadly. The CWE is listed as N/A by Oracle, but the 'Authentication Bypass' tag alongside a CVSS vector of PR:L (low privileges) and I:H (high integrity impact) strongly implies an improper authorization or broken access control flaw - a low-privileged user can invoke Metadata Plugin operations that should be restricted to higher-privileged OEM roles. The communication channel is HTTPS (AV:N), consistent with OEM's browser-based console architecture.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-46997 for both affected releases (13.5 and 24.1). Oracle does not publicly disclose specific fixed build numbers outside the CPU patch bundles - administrators should use Oracle's patch conflict checker and MOS (My Oracle Support) to identify the correct patch bundle for their environment. As an interim compensating control, restrict network access to OEM's HTTPS console to a dedicated administrative VLAN or VPN segment, preventing untrusted low-privileged users from reaching the Metadata Plugin endpoint. Additionally, audit OEM role assignments and remove Metadata Plugin access from accounts that do not require it; note this may require Oracle-specific role reconfiguration and could affect monitoring workflows if done broadly.