What is the CVSS score of CVE-2026-47006?

CVE-2026-47006 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Enterprise Manager are affected by CVE-2026-47006?

Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) contains a vulnerability allowing compromised administrative accounts to seize complete control of the platform, directly threatening…

How to fix or mitigate CVE-2026-47006?

Within 24 hours, inventory all Oracle Enterprise Manager Base Platform deployments running versions 13.5 and 24.1, document all high-privilege administrative account holders, and restrict administrative console access to a minimal trusted network segment using firewall rules. Within 7 days, enable comprehensive logging and audit trails for all administrative actions within the platform, configure alerts for privilege escalation attempts, and review recent administrative activity logs for suspicious behavior. Within 30 days, develop and test an upgrade plan to a patched version when available, establish a subscription to Oracle Critical Patch Updates to monitor for releases, and evaluate engagement with Oracle support for interim guidance or workarounds.

Oracle Enterprise Manager CVE-2026-47006

EUVD-2026-46495 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-vf33-jpc8-4xmh

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable HTTPS console with low complexity and no interaction, but full takeover requires pre-existing high OEM privileges (PR:H); complete C/I/A loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:21 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Self Update Framework component, where an authenticated high-privileged attacker reaching the console over HTTPS can compromise the confidentiality, integrity and availability of the entire management platform. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager (OEM) is Oracle's centralized IT-management console used to monitor and administer Oracle databases, middleware, engineered systems and hosts across an enterprise. The affected component, the Self Update Framework, is the mechanism OEM uses to download, stage and deploy plug-ins, agent software, connectors and other updatable entities. Because that framework fetches and applies executable/management content into the Oracle Management Service, weaknesses in how it validates or processes that content can translate into control over the management server itself. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class is unstated; the 'takeover' outcome combined with an update/deployment component is consistent with insufficient validation of or misplaced trust in update content leading to server compromise.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for Oracle Enterprise Manager Base Platform 13.5 and 24.1; Patch available per vendor advisory, with the exact patched build numbers enumerated on that CPU page, and Oracle recommends CPU patches be applied without delay. Because exploitation requires high OEM privileges, compensating controls until patching include tightly restricting and auditing accounts that hold administrative or Super Administrator roles in OEM, limiting network reachability to the OMS console by fronting the HTTPS interface behind an access-controlled network segment or VPN so it is not broadly exposed, and monitoring Self Update activity and plug-in/agent deployment jobs for unexpected changes; note that curtailing Self Update connectivity can interrupt legitimate plug-in and agent update workflows, so use Oracle's offline update procedures where connectivity is restricted.