What is the CVSS score of EUVD-2026-37351?

EUVD-2026-37351 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Enterprise Manager APM are affected by EUVD-2026-37351?

Oracle Enterprise Manager versions 13.5 and 24.1 contain a critical flaw in the APM/JADM component that permits unauthenticated remote attackers to alter performance data and disable service…

How to fix or mitigate EUVD-2026-37351?

24 hours: Inventory all Oracle Enterprise Manager 13.5 and 24.1 instances and document network access paths to APM/JADM ports; implement firewall rules restricting HTTP access to trusted administrative networks only. 7 days: Enable detailed logging and alerting on APM data modifications and service health state changes; escalate to Oracle support for patching timeline and interim guidance. 30 days: Continuously monitor for vendor patch release and apply immediately upon availability; if no patch released, escalate to enterprise leadership and implement alternative APM solution or air-gap affected systems from production networks.

Oracle Enterprise Manager APM EUVD-2026-37351

| CVE-2026-46858 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Apm Application Performance Management Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Oracle states unauthenticated HTTP exploitation of a network-facing OMS component with full integrity and availability loss but no confidentiality impact, matching AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:42 vuln.today

DescriptionCVE.org

Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise APM - Application Performance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all APM - Application Performance Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of APM - Application Performance Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

AnalysisAI

Remote unauthenticated tampering and denial-of-service in Oracle Enterprise Manager's APM (Application Performance Management) component, specifically the JADM / JVM Diagnostics module in versions 13.5 and 24.1, allows attackers reachable over HTTP to modify, create, or delete any APM-accessible data and to hang or repeatedly crash the service. The flaw is rated CVSS 9.1 with no privileges or user interaction required, but at time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Manager (OEM) is Oracle's flagship platform for monitoring and managing the full Oracle stack. The affected component is the Application Performance Management add-on, and more precisely the JVM Diagnostics (JVMD / JADM) subsystem, which receives telemetry from JVMD agents deployed in managed JVMs and exposes its management surface over HTTP through the OMS (Oracle Management Service). Because CWE data was not published by Oracle (their CPU advisories deliberately omit root-cause taxonomy), the underlying bug class cannot be cited authoritatively, but the CVSS impact profile of C:N/I:H/A:H against an unauthenticated HTTP endpoint is consistent with missing authorization or input-validation checks on a JVMD management/ingest servlet rather than memory corruption.

RemediationAI

Patch available per vendor advisory - apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for Enterprise Manager 13.5 and 24.1; Oracle's CPU does not enumerate a standalone version string for APM, so administrators must rely on the CPU bundle patches referenced in that advisory and verify via OPatch lsinventory after installation. Until the CPU can be applied, restrict network reachability to the OMS HTTP/HTTPS ports (default 7799/7803 and the upload port 4889/4900) so they are accessible only from the management subnet and JVMD-instrumented hosts, and consider temporarily stopping the JVMD engine via 'emctl extended oms jvmd stop -engines=all' - this disables APM JVM Diagnostics collection (losing JVM-level telemetry until re-enabled) but eliminates the vulnerable code path. Place a reverse proxy or WAF in front of OMS to drop unauthenticated requests to JVMD management URIs as a defense-in-depth measure, accepting that it does not substitute for the CPU.