What is the CVSS score of EUVD-2026-37348?

EUVD-2026-37348 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Enterprise Manager are affected by EUVD-2026-37348?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical vulnerability allowing low-privileged remote attackers to achieve complete platform takeover through the Metadata…

How to fix or mitigate EUVD-2026-37348?

Within 24 hours: Identify and inventory all Oracle EM Base Platform deployments (13.5 and 24.1 specifically) and assess network exposure. Within 7 days: Implement network access restrictions limiting Metadata Plugin access to authorized administrative networks only; segment EM infrastructure to prevent lateral movement to dependent Oracle systems; enable comprehensive audit logging of EM access and changes. Within 30 days: Monitor Oracle Critical Patch Updates (CPU) advisories for patch availability; prepare and validate emergency patching or version upgrade procedures.

Oracle Enterprise Manager EUVD-2026-37348

| CVE-2026-46855 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable OMS over HTTPS (AV:N), low complexity per Oracle (AC:L), requires any low-priv EM account (PR:L), no user interaction, and scope-changed full takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:43 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Enterprise Manager Base Platform 13.5 and 24.1 is possible by a low-privileged remote attacker via HTTPS, exploiting the Metadata Plugin component. The scope-changed flaw (CVSS 9.9) lets an attacker pivot to impact additional Oracle products beyond EM itself, and no public exploit identified at time of analysis.

Technical ContextAI

Oracle Enterprise Manager Base Platform is the central management console used to monitor and administer Oracle databases, middleware, engineered systems, and cloud workloads. The vulnerable Metadata Plugin component handles plugin metadata definitions consumed by the OMS (Oracle Management Server) over HTTPS. Although no CWE was assigned in the input, the CVSS scope change (S:C) combined with high CIA impact on additional products is characteristic of an authorization or input-handling defect in a privileged management endpoint that bridges trust boundaries between EM and the targets it manages.

RemediationAI

Apply Patch available per vendor advisory by installing the fixes for Oracle Enterprise Manager Base Platform 13.5 and 24.1 delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); exact patched build numbers should be taken directly from the CPU matrix as Oracle releases bundle patches per platform. Until the CPU is deployed, restrict network access to the OMS HTTPS console and upload endpoints to trusted management VLANs and jump hosts, tighten EM role assignments so that only essential operator accounts have any EM privileges (reducing the attack surface for the PR:L precondition), and monitor EM audit logs for unexpected Metadata Plugin operations or new plugin deployments. These compensating controls trade off some operator convenience and remote administration but do not replace the CPU patch, which is the only authoritative fix.