Oracle Enterprise Manager CVE-2026-47001

Exploitation requires a valid Oracle Enterprise Manager account with at least low-level privileges (PR:L per CVSS) - unauthenticated exploitation is not indicated. The attacker must have network access to the target system via HTTPS, which limits risk if the EM console is restricted to internal management networks. The vulnerability is specific to the Web Services Framework component, so only deployments where this component is active and reachable are exposed. No special non-default configuration is stated as required, suggesting the Web Services Framework is active in standard installations of versions 13.5 and 24.1. Exploitation is limited by: (1) requirement for pre-existing credentials, even if low-privileged; (2) no scope change - impact confined to the EM platform itself; (3) no availability impact - disruptive attacks are not enabled by this flaw alone.

The official CVSS 3.1 score of 5.4 (Medium) reflects the realistic bounded impact: network-exploitable, low complexity, no user interaction required, but limited to low-privileged authenticated sessions with no availability impact and partial confidentiality and integrity loss only. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N is internally consistent - the 'Easily exploitable' descriptor from Oracle aligns with AC:L. The tag 'Authentication Bypass' warrants scrutiny: the PR:L requirement contradicts a full authentication bypass scenario, suggesting this is actually an authorization bypass within an authenticated session, not unauthenticated access. EPSS data is not present in the provided intelligence, and no KEV listing or POC code is identified, making this lower-urgency than its tag implies. Real-world risk is moderate: Oracle Enterprise Manager deployments are common in large Oracle-centric enterprises, and privilege escalation within management infrastructure is a meaningful lateral movement risk. However, the S:U scope means impact is confined to the vulnerable system. The absence of an A impact vector and the requirement for pre-existing credentials further constrain urgency. This is a real priority in environments where Oracle EM is internet-facing or where insider threat and lateral movement are high concerns, but not an emergency patch for air-gapped or network-segmented deployments.

An attacker with a low-privileged Oracle Enterprise Manager account - such as a read-only operator or a service account - crafts HTTPS requests to Web Services Framework endpoints that bypass authorization checks, accessing monitoring data, configuration records, or management objects beyond their assigned role. The low complexity and absence of user interaction make this straightforward once credentials are obtained, for example through phishing or credential reuse. No public exploit code is known at time of analysis, so exploitation currently requires custom tooling or manual request manipulation.