What is the CVSS score of CVE-2026-47003?

CVE-2026-47003 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Enterprise Manager CVE-2026-47003

EUVD-2026-46492 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-38vm-m9w9-452w

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Vendor vector is consistent with the description: HTTPS-accessible bypass needing no auth, high complexity precondition, confidentiality-only impact, no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:38 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 expose an authentication bypass in the UI Framework component, reachable over HTTPS without credentials. Unauthenticated remote attackers who satisfy the high-complexity attack precondition can gain complete read access to all data visible within the OEM platform - a significant exposure given OEM's privileged visibility into monitored databases, hosts, and infrastructure credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the Authentication Bypass classification warrants prioritized patching in environments where the OEM console is network-accessible.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is an enterprise IT management and monitoring suite that centralizes oversight of Oracle databases, middleware, and infrastructure targets via a web-based console served over HTTPS. The vulnerable component is the UI Framework, responsible for rendering the management interface and enforcing access control on HTTP/S requests. The CPE identifier cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform confirms both the 13.5 and 24.1 release lines are affected. The vulnerability is tagged as an Authentication Bypass, indicating the UI Framework fails to correctly validate or enforce authentication state for certain request patterns or code paths. Oracle has not assigned a CWE, consistent with their standard CPU policy of limiting root-cause disclosure, so the precise weakness class - whether a missing authentication check, improper session validation, or request-smuggling pathway - cannot be confirmed from available data.

RemediationAI

Apply the patches distributed in Oracle's July 2026 Critical Patch Update, available through My Oracle Support and referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish exact patched build numbers in the public CPU summary; consult My Oracle Support for the specific patch IDs applicable to OEM 13.5 and 24.1 installations. If immediate patching is not feasible, restrict network access to the OEM HTTPS management interface to explicitly authorized IP ranges and management VLANs, preventing unauthenticated attackers from reaching the vulnerable endpoint. Additionally, consider disabling or proxying direct HTTPS access to the UI Framework from untrusted network segments and enabling access logging to detect anomalous unauthenticated request patterns against the console. Note that network-level restriction reduces exposure but does not eliminate the vulnerability, and must be validated against OEM's own network dependency requirements to avoid disrupting agent-to-console communications.