What is the CVSS score of CVE-2026-46999?

CVE-2026-46999 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-46999?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a vulnerability enabling remote, unauthenticated attackers to manipulate critical infrastructure management data, read sensitive…

How to fix or mitigate CVE-2026-46999?

Within 24 hours, inventory all systems running Oracle Enterprise Manager Base Platform versions 13.5 or 24.1 and document their network exposure and trust boundaries. Within 7 days, implement network segmentation and firewall rules restricting HTTPS access to the Discovery Framework console to authorized administrative networks only, and enable detailed audit logging on all affected systems. Within 30 days, establish continuous monitoring of Oracle security advisories and finalize an upgrade plan to move immediately to a patched version once the vendor releases a fix.

Oracle Enterprise Manager CVE-2026-46999

EUVD-2026-46488 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-2cf9-g583-rrv8

Denial Of Service Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

7.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.0 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

7.0 HIGH

Unauthenticated HTTPS reach gives AV:N/PR:N/UI:N; Oracle's 'difficult to exploit' warrants AC:H; impacts weighted to integrity (I:H) with partial confidentiality and DoS (C:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:19 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

HIGH 7.0

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).

AnalysisAI

Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager (OEM) is Oracle's centralized management platform for monitoring and administering databases, middleware, applications, and infrastructure. The flaw resides in the Discovery Framework component of the Base Platform - the subsystem responsible for detecting and registering managed targets/agents into the OEM repository. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform. No CWE was assigned in the source data, so the exact root-cause class is not disclosed by Oracle; the CVSS profile (network HTTPS vector, no privileges, high integrity impact, low confidentiality/availability impact) is consistent with an input-validation or access-control weakness in the discovery/registration handling that lets an unauthenticated request manipulate repository data. The high attack complexity (AC:H) indicates the attacker must win a race, defeat a non-trivial precondition, or rely on environmental factors outside their direct control.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; an exact fixed build string is not enumerated in the input, so pull the precise patch/bundle numbers for OEM 13.5 and 24.1 directly from that CPU. Oracle strongly recommends applying CPU patches without delay and keeping supported versions current. Until the patch is deployed, reduce exposure of the OEM console: restrict network access to the OEM HTTPS management interface to trusted administrative networks/VPN and management VLANs rather than exposing it broadly, place it behind a reverse proxy or WAF, and tighten firewall rules so only authorized hosts can reach the Discovery Framework endpoints - the trade-off is that overly aggressive network restriction can break legitimate agent discovery/registration and remote administrator access, so scope allowlists to known agent and admin subnets. Monitor OEM repository data and discovery/registration activity for unexpected creation, deletion, or modification of targets as a detective control.