Oracle Enterprise Manager CVE-2026-47000

Exploitation requires three concrete prerequisites: first, the attacker must hold a valid low-privileged account on the Oracle Enterprise Manager Base Platform 24.1 instance (PR:L per CVSS); second, the attack must be delivered over HTTPS to a network-accessible EM console; third, human interaction from a person other than the attacker is required (UI:R per CVSS) - meaning a legitimate user must take an action, such as clicking a link or interacting with attacker-influenced content within the platform. Exploitation is strictly limited to Oracle Enterprise Manager Base Platform version 24.1; no other versions are confirmed affected. The impact is bounded to limited integrity modification of data accessible within the EM platform - confidentiality and availability are not affected. The 'Authentication Bypass' tag suggests the Security Framework flaw may elevate the attacker's effective permissions, but an initial authenticated session remains a hard prerequisite based on the CVSS PR:L metric.

Real-world risk is low. The CVSS 3.5 base score reflects the cumulative weight of limiting factors: PR:L requires a valid low-privileged account; UI:R demands that a secondary victim interact with attacker-supplied content; and the sole impact is I:L - limited, partial data modification with no confidentiality or availability consequences (C:N, A:N). No EPSS probability score was provided in the input data, so exploitation likelihood cannot be quantified beyond the CVSS signal. There is no CISA KEV listing and no POC reported, meaning no public exploit code has been identified at time of analysis. The 'Authentication Bypass' tag introduces a minor inconsistency with PR:L - a true authentication bypass would typically warrant PR:N - suggesting the bypass elevates permissions within an already-authenticated session rather than granting access without credentials. This distinction is not clarified in the vendor description and should be verified against the Oracle advisory. Overall, this vulnerability represents a credible but low-priority finding: meaningful only in contexts where a malicious insider or compromised low-privileged account can direct victim interaction, and the damage is confined to limited data modification.

A low-privileged insider or attacker with a stolen low-privileged Oracle Enterprise Manager account crafts a malicious HTTPS request or link targeting the Security Framework component, then induces a legitimate EM user to click or interact with it - through phishing, a crafted dashboard element, or social engineering. Upon victim interaction, the Security Framework authorization controls are bypassed, allowing the attacker to perform unauthorized insert, update, or delete operations on data accessible within the attacker's Enterprise Manager context. No public exploit code has been identified at time of analysis.