What is the CVSS score of CVE-2026-47005?

CVE-2026-47005 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-47005?

Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) contains a critical vulnerability in its Self Update Framework that enables complete platform compromise by high-privileged…

How to fix or mitigate CVE-2026-47005?

Within 24 hours, identify and inventory all Enterprise Manager Base Platform instances running versions 13.5 or 24.1, document their network exposure and HTTPS access endpoints, and audit which high-privileged accounts and service identities have administrative access. Within 7 days, implement network segmentation to restrict HTTPS connectivity to the Self Update Framework component from only approved administrative networks, enforce additional access controls to minimize standing high-privileged account usage, and enable comprehensive audit logging of all authenticated sessions. Within 30 days, establish continuous monitoring for this CVE while awaiting vendor patch release, develop a prioritized remediation plan for when Oracle releases a fix, and conduct a comprehensive privilege review to eliminate unnecessary elevated access across all Enterprise Manager administrative accounts.

Oracle Enterprise Manager CVE-2026-47005

EUVD-2026-46494 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-h572-c24f-cjm4

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTPS reach with low complexity and no user interaction, but the Self Update abuse requires an existing high-privilege OEM account (PR:H), yielding full C/I/A takeover.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:20 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through its Self Update Framework component, allowing an already high-privileged, authenticated attacker with network/HTTPS access to escalate to complete takeover of the platform with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Enterprise Manager centrally administers large Oracle estates, a takeover here is a high-value pivot despite the elevated privilege prerequisite.

Technical ContextAI

Oracle Enterprise Manager (OEM) is Oracle's centralized management console for databases, middleware, engineered systems, and cloud/on-prem infrastructure; the Base Platform (OMS - Oracle Management Service) is the core server tier. The affected component is the Self Update Framework, the subsystem OEM uses to download and apply plug-ins, agent software, connectors, and metadata updates from My Oracle Support. Oracle did not assign a CWE (listed N/A), so the exact root-cause class is not disclosed, but abuse of an update/self-provisioning framework by a privileged user typically maps to improper access control or unsafe processing of update content, which explains how a high-privileged actor can convert their existing access into full platform takeover.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update for the affected OEM Base Platform releases (13.5 and 24.1) as documented at https://www.oracle.com/security-alerts/cpujul2026.html - patch data is available per vendor advisory, but no single fixed build string is given in the input, so consult the CPU matrix for the exact system patch/OMS patch for your version and apply it. Because exploitation requires high privileges (PR:H), the most effective compensating controls until patching are to aggressively minimize and audit OEM super-administrator and privileged operator accounts, enforce strong authentication/MFA on the OMS console, and restrict network access to the OEM console and its HTTPS endpoints to a trusted management network or jump hosts (side effect: administrators must connect through the bastion, adding friction). Tightening access to Self Update / plug-in management functions and monitoring the Self Update job/audit logs for unexpected update activity further reduces exposure; these controls limit but do not eliminate risk from an already-privileged insider, so patching remains primary.