EUVD-2026-46487
GHSA-84qj-r5qq-3ccm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated network HTTPS reach (AV:N/PR:N) at low complexity, but a required action by another user (UI:R) and full takeover justify C/I/A:H with scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.
Technical ContextAI
Oracle Enterprise Manager (OEM) Base Platform is Oracle's centralized console for managing and monitoring databases, middleware, and engineered systems; the affected code resides in its Metadata Plugin component, which processes plugin metadata within the web-facing management tier. The CWE is listed as N/A, so the precise weakness class is unstated, but the combination of an unauthenticated HTTPS vector with a mandatory user-interaction requirement (UI:R) is characteristic of a client-side or request-forgery style vector - for example, tricking an authenticated operator into loading crafted content that the platform then processes with the victim's authority. The single affected CPE (cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform) confirms scope is limited to the OEM Base Platform product rather than the managed targets, though a compromised OEM console is a high-value pivot into every system it manages.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 as the primary remediation - patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs deliver product-specific patches for OEM 13.5 and 24.1, so apply the OEM Base Platform bundle corresponding to your installed version rather than an invented version number. Until patching, reduce exposure by restricting network access to the OEM management HTTPS interface to trusted administrative networks or a management VPN (trade-off: legitimate remote admins must route through the allowed network), and reinforce the user-interaction dependency by cautioning operators against following untrusted links or loading external content while authenticated to OEM, since UI:R means the attack cannot succeed without an operator action. Because this is a management plane, also monitor OEM administrative sessions and audit logs for anomalous plugin/metadata activity as a detective control while patching is scheduled.
Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker v
Privileged takeover of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is possible through the Metadata P
Privilege escalation and full takeover in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Target Management compo
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework
Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network a
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated
Remote takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible when an unauthenticated attacker ov
Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to
Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible via the Deployment Library comp
Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Event Manageme
Privileged remote tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 (Install component) allows an authe
Share
External POC / Exploit Code
Leaving vuln.today