Oracle Enterprise Manager CVE-2026-47002

Exploitation requires that a person other than the attacker - specifically, an active user of Oracle Enterprise Manager Base Platform - interact with attacker-controlled content while their browser has an active EM session (UI:R). The attack is delivered over HTTPS (AV:N) and requires no authentication or privilege on the attacker's side (PR:N). No special non-default configuration is indicated. Exploitation is limited to versions 13.5 and 24.1 specifically. The key limiting factor is the mandatory human interaction step: the attacker cannot autonomously exploit this vulnerability without inducing a victim EM user to take an action, such as clicking a crafted link or visiting a malicious page. This prevents automated, mass exploitation. Impact is further bounded to limited read and write access to EM-accessible data only - full system compromise or availability disruption is not achievable via this vulnerability.

The CVSS 3.1 base score of 6.1 (Medium) reflects limited C:L and I:L impacts with no availability impact, which is proportionate given the attacker cannot achieve full system compromise. However, several signals elevate practical concern: the scope change (S:C) indicates the attacker's payload executes beyond the attacked component, likely in the victim's browser, enabling session hijacking or data exfiltration from the user's EM context. The 'Authentication Bypass' tag further suggests this could enable access beyond what the victim's own session would normally permit. Mitigating signals include the UI:R requirement - exploitation is not fully automatable, as a privileged EM user must interact with attacker-controlled content - and the absence of both KEV listing and public exploit code. No EPSS score was provided in the source data; without it, exploitation probability cannot be quantified. The real-world priority is moderate: organizations with Oracle EM exposed to untrusted users or phishing-susceptible administrators should treat this as a meaningful patching obligation given EM's typically privileged access to Oracle infrastructure.

An attacker crafts a malicious HTTPS URL or page targeting the Oracle Enterprise Manager UI Framework and delivers it to an authenticated EM administrator via phishing email or compromised intranet page. When the administrator clicks the link or loads the page, the attacker's payload executes within the victim's EM browser session, enabling the attacker to read a subset of accessible EM data and perform unauthorized insert, update, or delete operations - potentially modifying monitoring configurations or suppressing alerts across managed Oracle targets. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) suggests the vulnerability is straightforward to exploit once identified.