What is the CVSS score of CVE-2026-47001?

CVE-2026-47001 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Enterprise Manager CVE-2026-47001

EUVD-2026-46490 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-7w72-f9wr-4mwv

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network vector and low complexity align with HTTPS exposure; PR:L confirmed by Oracle description; no scope change or availability impact observed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:35 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Web Services Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authorization bypass in the Web Services Framework component, allowing low-privileged authenticated attackers to access and manipulate restricted data over HTTPS. Despite requiring valid credentials, the flaw circumvents authorization controls, enabling unauthorized read of a subset of platform data and unauthorized write/insert/delete operations against accessible records. No public exploit code or active CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle Enterprise Manager Base Platform is an enterprise IT monitoring and management suite. The affected component - the Web Services Framework - handles HTTPS-based web service interactions, likely including REST or SOAP endpoints used internally or exposed to authenticated management clients. The CPE string (cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform) confirms the affected software is the base platform itself, not a plugin. The CWE is not assigned by the reporter, but the 'Authentication Bypass' tag combined with PR:L in the CVSS vector suggests this is more precisely an authorization bypass: an already-authenticated low-privileged user bypasses object-level or role-level access controls within web service endpoints, gaining access to data and operations their role should not permit. The root cause class most closely maps to CWE-863 (Incorrect Authorization) or CWE-285 (Improper Authorization), inferred from context rather than confirmed by Oracle.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html - no independently confirmed specific fix version number is available beyond the CPU release itself. Oracle CPUs are cumulative, so the latest patch set for the affected 13.5 and 24.1 release trains should be applied. If immediate patching is not feasible, restrict network access to the Web Services Framework endpoints to trusted management networks or VPN only, as the attack vector is HTTPS over the network (AV:N); reducing the attacker pool to trusted internal users limits exposure. Additionally, audit and tighten role-based access controls within Oracle EM to reduce the blast radius if low-privileged accounts are compromised. Disabling web service features not actively used may further reduce attack surface, though Oracle EM's web service layer is typically core to its functionality. Note that network segmentation as a compensating control does not eliminate the risk from insider threats or already-compromised internal accounts.