Oracle Enterprise Manager CVE-2026-47005

Exploitation requires an authenticated session with high privileges on the Oracle Enterprise Manager Base Platform (CVSS PR:H) and network access to the OMS over HTTPS; the attack specifically targets the Self Update Framework component on OEM Base Platform 13.5 or 24.1. The strongest limiting factor is the PR:H prerequisite - this cannot be performed by an unauthenticated or low-privileged user, so the realistic threat is a malicious insider or an already-compromised administrative/operator account. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning that once the privileged access exists the attack is straightforward and reliable, but the high-privilege gate is what keeps this from being remotely exploitable against default anonymous access.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) shows a network-reachable, low-complexity attack with no user interaction and complete C/I/A impact, but crucially PR:H - the attacker must already hold high privileges on OEM. This significantly narrows the realistic threat to malicious or compromised administrative/operator accounts rather than anonymous internet attackers, which is why the score lands at 7.2 (High) rather than Critical despite total impact. No EPSS score, no SSVC decision, and no CWE were provided, and there is no POC or CISA KEV listing, so there is no evidence of active or automatable exploitation; the primary signals are Oracle's own advisory and CVSS. The real-world priority is elevated for organizations exposing OEM broadly or with many privileged accounts, but the PR:H barrier means this is closer to a privilege-abuse/insider-and-post-compromise risk than a mass-exploitation emergency - note the vendor calls it 'easily exploitable,' which refers to attack complexity once privileged, not to bypassing the authentication requirement.

An attacker who has obtained high-privilege OEM credentials - for example a rogue administrator or an operator account compromised via phishing or credential reuse - connects to the Oracle Management Service over HTTPS and abuses the Self Update Framework to escalate from their privileged role to full takeover of the Base Platform. No user interaction or additional social engineering is needed once the privileged session exists, and from a compromised OMS the attacker can pivot to every managed target. No public exploit code has been identified at time of analysis.