Oracle Enterprise Manager CVE-2026-46999

The attacker needs network access to the Oracle Enterprise Manager Base Platform HTTPS console (AV:N) and no credentials (PR:N, unauthenticated) and no user interaction (UI:N), targeting the Discovery Framework component of OEM Base Platform 13.5 or 24.1. The key LIMITING factor is high attack complexity (AC:H): Oracle labels it 'difficult to exploit,' indicating a required non-trivial precondition - such as a race condition, specific timing, or environmental/configuration state the attacker cannot fully control - must be met, so this is not reliably repeatable against arbitrary reachable instances. Exposure is further bounded by whether the OEM management interface is network-reachable to the attacker; OEM consoles are typically internal administrative endpoints, so internet exposure materially raises risk while segmented deployments limit it.

The CVSS 3.1 base score is 7.0 (High), driven by unauthenticated network reach (AV:N/PR:N/UI:N) and high integrity impact (I:H), but tempered by high attack complexity (AC:H) and only low confidentiality and availability impact (C:L/A:L). No EPSS score was provided, so exploitation probability cannot be quantified from the input. The vulnerability is NOT in CISA KEV and no POC/exploit code is referenced, so this is not a confirmed active-exploitation situation - no public exploit identified at time of analysis. The dominant real-world mitigant is AC:H: Oracle explicitly calls it 'difficult to exploit,' meaning that despite the unauthenticated network vector, reliable weaponization is non-trivial and this is more likely of interest for targeted attacks than mass exploitation. The primary concern is integrity - an attacker could tamper with the management platform's data, which for a tool that administers databases and infrastructure carries outsized downstream consequences. Net: prioritize patching in the normal Oracle CPU cycle (elevated because OEM is a high-value administrative control plane), but there is no signal of imminent widespread exploitation.

A remote attacker who can reach the OEM console over HTTPS (for example, an internet-exposed or lateral-network-accessible management interface) sends crafted requests to the Discovery Framework without authenticating. After satisfying the difficult (AC:H) preconditions, they tamper with critical repository data - creating, altering, or deleting managed-target records - read a subset of OEM data, and degrade platform availability. No public exploit code is currently identified, so a real attack would require the adversary to develop the exploit.