Oracle Enterprise Manager CVE-2026-47006

Exploitation requires the attacker to already hold high OEM privileges (CVSS PR:H) and network reachability to the Oracle Enterprise Manager Base Platform console over HTTPS; the specific attack surface is the Self Update Framework component in OEM Base Platform 13.5 or 24.1. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once privileged access and HTTPS reachability exist, exploitation is straightforward. The principal limiting factors are the high-privilege prerequisite - this cannot be triggered by an unauthenticated or low-privileged actor - and that only versions 13.5 and 24.1 are named affected; realistic risk is therefore confined to environments where a privileged OEM account can be obtained or abused.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2 High) is internally consistent: network-reachable over HTTPS, low attack complexity, no user interaction, but requiring high privileges (PR:H). That PR:H requirement is the decisive limiter - an attacker must already hold high OEM privileges, which sharply narrows the viable attacker population and makes this primarily a post-compromise or trusted-insider escalation concern rather than a mass-exploitable perimeter bug. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so all exploitation signals point to low near-term likelihood. Impact if exploited is severe (complete platform takeover, high C/I/A), and because OEM administers many downstream systems a compromise could become a pivot across the estate - making this a 'patch on the normal CPU schedule' item for OEM operators rather than a drop-everything emergency.

An attacker who has already obtained a high-privileged Oracle Enterprise Manager account - for example via a compromised OEM administrator credential or a malicious insider - connects to the OMS console over HTTPS and abuses the Self Update Framework to compromise the Base Platform. With low complexity and no user interaction required, the attacker escalates from privileged console access to full takeover of the management server and can then pivot toward the many targets OEM administers. No public proof-of-concept is currently available.