Oracle Enterprise Manager CVE-2026-46998

Exploitation targets the Metadata Plugin component of Oracle Enterprise Manager Base Platform 13.5 or 24.1 and is reachable over the network via HTTPS with no attacker authentication (PR:N). The critical limiting condition, taken directly from the CVSS vector and description, is UI:R: the attack requires human interaction from a person other than the attacker - an authorized OEM user must be induced to interact with attacker-controlled content for the attack to succeed. There is no privilege requirement and attack complexity is low, but the dependency on tricking a legitimate user (rather than a zero-click path) is the primary factor that constrains realistic exploitation, along with the requirement that the target be an exposed, unpatched OEM Base Platform instance on an affected version.

Oracle rates this CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: network-reachable, low complexity, no privileges required, dependent on user interaction, full CIA impact, scope unchanged. The unauthenticated plus low-complexity profile raises real-world risk, while UI:R is the main limiting factor - exploitation needs a person other than the attacker to act, so this is not a fully automatable, worm-like flaw. No EPSS score was supplied, so exploitation probability cannot be quantified from this data, and no SSVC decision record was provided. There is no CISA KEV entry and no public POC in the input, so this is not confirmed as actively exploited - the priority derives from severity and the strategic value of the target (a management plane), not from observed attacks. Net: a genuine high-priority patch for Oracle shops, but the user-interaction dependency makes mass exploitation less likely than a zero-click unauthenticated RCE.

An attacker crafts a malicious HTTPS request or link targeting the OEM Metadata Plugin and delivers it to an OEM operator, for example via a phishing email or a link to a page that auto-submits the request. When the authenticated administrator interacts with it, the crafted content is processed by the Base Platform and results in takeover of the OEM console, granting high-impact control. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:R) rather than a released POC.