Oracle Enterprise Manager CVE-2026-46997

Exploitation requires: (1) a valid low-privileged OEM user account (PR:L per CVSS - anonymous access is not sufficient); (2) network reachability to the OEM platform's HTTPS interface on the standard management port; (3) the target system running Oracle Enterprise Manager Base Platform version 13.5 or 24.1. The 'Authentication Bypass' tag suggests the flaw triggers when the low-privileged user invokes specific Metadata Plugin operations that should be gated to higher-privileged roles - meaning any authenticated OEM user may be able to exploit this, not just administrators. No specific non-default configuration or unusual deployment mode is cited as a prerequisite. Exploitation is limited by: the requirement for at least one valid OEM credential (eliminating fully unauthenticated external attackers), and by organizations that restrict OEM HTTPS access to administrative networks (reducing the attacker pool to trusted users). There is no confidentiality or availability impact - the scope is limited to integrity of OEM-managed data.

The vendor-assigned CVSS 3.1 score of 6.5 Medium accurately reflects the integrity-focused impact and low-privilege requirement, but may understate organizational risk in OEM-heavy environments. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates straightforward network exploitation requiring only a valid low-privileged credential - no special conditions, no user interaction. The 'Authentication Bypass' tag introduces an important nuance: if the flaw enables privilege escalation within OEM's internal authorization model, a low-privileged OEM monitoring account could manipulate configurations controlling production Oracle Database environments, amplifying blast radius far beyond what the CVSS score alone conveys. No EPSS score was provided, KEV status is absent (no confirmed active exploitation), and no public POC is known. The realistic priority is elevated for organizations where OEM manages business-critical databases and where OEM HTTPS access is available to users beyond a small, trusted administrator pool.

A developer or DBA holding a low-privileged OEM monitoring account authenticates to the OEM HTTPS console and sends a crafted request to the Metadata Plugin endpoint - bypassing the authorization check that should restrict write operations to administrator-level roles. The attacker silently modifies or deletes managed target metadata, potentially removing production databases from OEM visibility, altering alerting thresholds, or corrupting configuration records. No public POC is known at time of analysis, but the low complexity means this attack path is discoverable through routine API exploration by a motivated insider.