What is the CVSS score of EUVD-2026-37335?

EUVD-2026-37335 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by EUVD-2026-37335?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical vulnerability enabling authenticated users to achieve full administrative compromise of the platform and pivot to…

How to fix or mitigate EUVD-2026-37335?

Within 24 hours: identify all instances of Enterprise Manager 13.5 and 24.1 in production; restrict HTTPS access to Enterprise Manager via firewall rules to whitelisted administrative IP ranges only; review and disable unnecessary low-privilege service accounts with platform access. Within 7 days: enable detailed audit logging on Discovery Framework component access; implement real-time alerting for privilege escalation attempts and framework API calls; complete network access audit to identify external connectivity to Enterprise Manager. Within 30 days: establish timeline with Oracle for upgrade to patched version when released; evaluate network segmentation to isolate Enterprise Manager from production databases and systems.

Oracle Enterprise Manager EUVD-2026-37335

| CVE-2026-46832 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

OEM is reachable over HTTPS (AV:N), exploitation is low-complexity (AC:L), a low-privileged account is required (PR:L), no user interaction is needed, and takeover plus scope change yields S:C with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:50 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privileged takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible through the Discovery Framework component, where a low-privileged authenticated attacker with HTTPS access can fully compromise the platform and impact adjacent products via a scope change. The flaw carries a CVSS 3.1 score of 9.9 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Oracle disclosed this in the June 2026 Critical Patch Update advisory (cspujun2026), and exploitation is rated low complexity.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's flagship management product used to monitor, administer, and orchestrate Oracle databases, middleware, engineered systems, and cloud workloads across enterprise estates. The vulnerable component is the Discovery Framework, the subsystem that detects, registers, and tracks managed targets across the OEM agent fleet - making it a privileged, high-trust pathway into the management plane. CPE data (cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform:*) and EUVD records confirm versions 13.5 and 24.1 are in scope. No CWE was assigned by NVD, but the CVSS scope-change (S:C) combined with full CIA impact and a Discovery Framework entry point is consistent with an authorization or input-handling weakness in the discovery workflow that allows pivoting beyond OEM's security boundary into managed targets.

RemediationAI

Apply the patches delivered in the Oracle June 2026 Critical Patch Update (cspujun2026) for Oracle Enterprise Manager Base Platform 13.5 and 24.1 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - patch available per vendor advisory, with exact bundle patch numbers to be obtained from the CPU matrix and My Oracle Support. Until patches are deployed, restrict network reachability of the OEM console and Discovery Framework endpoints to a dedicated management VLAN or jump-host bastion so that only administrators can reach HTTPS interfaces, accepting the trade-off that monitoring agents and integrations must still route to OEM. Audit and prune OEM user accounts and roles to eliminate unnecessary low-privilege users (which satisfy the PR:L prerequisite), enforce MFA on remaining accounts, and increase logging on discovery and target-registration activity to detect anomalous scope-changing operations; note that role pruning may temporarily break dashboards or self-service flows for affected users.