What is the CVSS score of CVE-2026-47004?

CVE-2026-47004 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager Base Platform are affected by CVE-2026-47004?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are vulnerable to complete platform takeover via the Self Update Framework component, allowing a low-privileged attacker with network…

How to fix or mitigate CVE-2026-47004?

Within 24 hours, identify all instances of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 in production and development environments and implement network-level access controls to restrict connectivity to trusted administrative users only. Within 7 days, contact Oracle Support for definitive patch availability and timeline for CVE-2026-47004; disable or restrict access to the Self Update Framework component pending patch release. Within 30 days, apply the vendor-released patch to all affected instances upon availability and conduct forensic analysis of Enterprise Manager activity logs and authentication records to detect unauthorized access attempts during the vulnerability exposure window.

Oracle Enterprise Manager Base Platform CVE-2026-47004

EUVD-2026-46493 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-h29c-gm2v-pjcf

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:20 vuln.today

CVE Published

Jul 21, 2026 - 21:32 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Enterprise Manager Base Platform is possible through the Self Update Framework component in versions 13.5 and 24.1, where a low-privileged attacker with network access over HTTPS can escalate to complete takeover of the platform. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.