What is the CVSS score of EUVD-2026-37346?

EUVD-2026-37346 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by EUVD-2026-37346?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical vulnerability allowing remote compromise of the management platform itself through social engineering attacks against…

How to fix or mitigate EUVD-2026-37346?

24 hours: Identify all Oracle Enterprise Manager Base Platform installations (13.5 and 24.1); restrict network access to the console to internal networks only; disable remote/internet-facing access if possible; alert security teams and administrators to the phishing/social engineering vector. 7 days: Deploy network controls such as WAF rules and IDS signatures focused on Metadata Plugin HTTP requests; strengthen email filtering to detect phishing impersonating Oracle communications; restrict administrative access to least-privilege model. 30 days: Monitor Oracle security advisories for patch release; evaluate isolation strategies or architecture changes to reduce Enterprise Manager blast radius; conduct post-incident exercises assuming Enterprise Manager compromise to strengthen downstream system resilience.

Oracle Enterprise Manager EUVD-2026-37346

| CVE-2026-46853 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform XSS

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-reachable HTTP endpoint with no attacker credentials but required victim interaction; Metadata Plugin flaw produces scope change with full takeover of OEM and managed products.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:44 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Cross-scope takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated remote attackers to fully compromise the management platform - and potentially additional managed products - by tricking an authenticated user into interacting with a malicious HTTP-delivered payload targeting the Metadata Plugin component. The CVSS 3.1 base score is 9.6 with a scope change reflecting impact beyond the vulnerable component, and at time of analysis no public exploit identified at time of analysis. Because Oracle Enterprise Manager centrally controls fleets of Oracle databases, middleware, and infrastructure, successful exploitation has outsized blast-radius implications for downstream Oracle estates.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's flagship on-premises management console for monitoring and administering Oracle databases, Fusion Middleware, Engineered Systems, and hosts. The flaw resides in the Metadata Plugin component, which handles plugin-supplied metadata definitions consumed by the OEM console and agents over HTTP. No CWE is assigned in the input, but the combination of network attack vector, required user interaction, and scope change is characteristic of a client-side or server-side processing weakness (for example metadata injection, deserialization, or XSS-to-privileged-action chain) where a victim user's authenticated session is leveraged to perform actions whose effects cross into other Oracle products managed by OEM. The CPE 'cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform' confirms the Base Platform itself - not a specific plug-in pack - is the vulnerable component.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (cspujun2026) to OEM Base Platform 13.5 and 24.1 as soon as a maintenance window allows; exact patch bundle identifiers are listed in the advisory at https://www.oracle.com/security-alerts/cspujun2026.html - patch available per vendor advisory, no standalone fixed build number is specified in the input. Until patches are applied, restrict the OEM console and agent HTTP/HTTPS endpoints to a dedicated management VLAN or jump-host network so unauthenticated attackers cannot reach them (trade-off: breaks remote admin from user workstations and may require VPN reconfiguration), require admins to use isolated browser profiles dedicated to OEM and avoid following untrusted links while logged in to mitigate the UI:R requirement, and monitor OEM audit logs for unexpected metadata plugin uploads or administrative actions. Avoid disabling the Metadata Plugin component itself, as OEM relies on it for normal operation.