Oracle Enterprise Manager Base Platform CVE-2026-47004

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are vulnerable to complete platform takeover via the Self Update Framework component, allowing a low-privileged attacker with network access to gain full administrative control of IT infrastructure monitoring and all protected systems. With CVSS 8.8 and vendor-rated as easily exploitable, any organization running these versions faces immediate risk to enterprise-wide system visibility and operational control. No vendor patch currently exists to remediate this exposure.

Within 24 hours, identify all instances of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 in production and development environments and implement network-level access controls to restrict connectivity to trusted administrative users only. Within 7 days, contact Oracle Support for definitive patch availability and timeline for CVE-2026-47004; disable or restrict access to the Self Update Framework component pending patch release. Within 30 days, apply the vendor-released patch to all affected instances upon availability and conduct forensic analysis of Enterprise Manager activity logs and authentication records to detect unauthorized access attempts during the vulnerability exposure window.

Since no vendor-released patch is identified at time of analysis, disable or restrict the Self Update Framework component to trusted network paths only; implement authentication and authorization logging with alerting on privilege escalation attempts; restrict remote access to Enterprise Manager console to administrative users behind VPN or bastion hosts; and consider temporarily disabling automated self-updates in favor of manual, controlled patch deployment until a vendor patch is released.