What is the CVSS score of EUVD-2026-37350?

EUVD-2026-37350 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Enterprise Manager are affected by EUVD-2026-37350?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain a critical unauthenticated remote code execution vulnerability (CVSS 9.8) accessible via standard HTTP requests without prior…

How to fix or mitigate EUVD-2026-37350?

Within 24 hours: Conduct immediate inventory of all Oracle Enterprise Manager Base Platform 13.5 and 24.1 instances in your environment; implement network-level access controls restricting HTTP/HTTPS connections to designated administrative networks only; enable comprehensive logging of all Enterprise Manager traffic and authentication events. Within 7 days: Contact Oracle Support to confirm patching timeline and interim remediation guidance; implement Web Application Firewall rules to detect and block exploitation attempts targeting Enterprise Manager; evaluate operational impact of temporarily taking non-critical Enterprise Manager instances offline. Within 30 days: Deploy vendor patch to all Enterprise Manager instances upon release; conduct forensic review of Enterprise Manager logs and connected systems for unauthorized administrative access.

Oracle Enterprise Manager EUVD-2026-37350

| CVE-2026-46857 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Enterprise Manager Base Platform Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP exploitation with takeover impact, so AV:N/AC:L/PR:N/UI:N with full C/I/A; scope unchanged as compromise stays within the EM trust boundary.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:42 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote code execution in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 allows unauthenticated network attackers to fully compromise the Oracle Management Service via HTTP. The flaw is rated CVSS 9.8 with low attack complexity and no user interaction, enabling complete takeover of the management platform. No public exploit identified at time of analysis, but the trivial exploitation profile and the platform's privileged role across managed Oracle estates make it a high-priority patching target.

Technical ContextAI

Oracle Enterprise Manager Base Platform is the central management framework Oracle customers use to monitor and administer databases, middleware, and engineered systems. The vulnerable component is the Oracle Management Service (OMS), the HTTP-facing tier (typically WebLogic-based) that brokers communication between agents, the management repository, and the console. CWE is not assigned in the input; based on the CVSS vector (network, low complexity, no privileges, no UI) and Oracle's 'takeover' language, the root cause is most plausibly an authentication bypass or unauthenticated request-handling flaw in an OMS HTTP endpoint, but the precise weakness class is not disclosed by Oracle's advisory style. The CPE cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform covers the platform itself rather than a specific OMS subcomponent.

RemediationAI

Apply the patch available per vendor advisory in Oracle's June 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cspujun2026.html, covering Enterprise Manager Base Platform 13.5 and 24.1; Oracle's CPU bundles the specific OMS patch IDs and prerequisite stack patches that should be applied to each OMS home. Until the CPU can be staged, restrict network reachability of the OMS HTTPS console and upload ports (typically 7799/7803 and the 4900-range) to a trusted management VLAN or jump-host range, recognising that this breaks agent uploads from any host outside the allowlist and may leave targets unmonitored. Place a reverse proxy or WAF in front of OMS to log and rate-limit unauthenticated HTTP requests, accepting the operational cost of console latency and potential agent timeouts, and rotate any OMS-stored credentials after patching given the takeover-class impact.