What is the CVSS score of EUVD-2026-37359?

EUVD-2026-37359 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Enterprise Manager are affected by EUVD-2026-37359?

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 contain an unauthenticated remote vulnerability enabling attackers to disrupt critical management operations and alter system…

How to fix or mitigate EUVD-2026-37359?

Within 24 hours: Identify all deployments of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1, and restrict HTTPS network access to the Agent Next Gen component to known administrator IP addresses only. Within 7 days: Implement mandatory VPN or jump-box access requirements for remote management console connections, and establish continuous monitoring of Oracle security advisories for patch availability. Within 30 days: Contact Oracle support regarding migration to patched versions, deploy Web Application Firewall rules to detect anomalous management console activity, and establish enhanced logging for configuration modification events.

Oracle Enterprise Manager EUVD-2026-37359

| CVE-2026-46866 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-16 oracle

Denial Of Service Oracle Oracle Enterprise Manager Base Platform

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

8.2 HIGH

Unauthenticated HTTPS reachability with no UI matches AV:N/AC:L/PR:N/UI:N; complete DoS gives A:H, partial data modification gives I:L, no confidentiality impact gives C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:37 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Manager Base Platform as well as unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

AnalysisAI

Remote denial-of-service and data tampering in Oracle Enterprise Manager Base Platform 13.5 and 24.1 allows unauthenticated network attackers to crash or hang the management console and to perform unauthorized modifications to a subset of accessible data via the Agent Next Gen component over HTTPS. Oracle rates the issue CVSS 8.2 and notes the flaw is easily exploitable; no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.

Technical ContextAI

Oracle Enterprise Manager (OEM) Base Platform is Oracle's centralized management and monitoring console for Oracle databases, middleware, engineered systems, and cloud workloads. The vulnerable surface is the Agent Next Gen component, which mediates HTTPS communications between the central OMS (Oracle Management Service) and managed-target agents. While no CWE is published, the combination of availability-high and integrity-low impacts on an unauthenticated HTTPS endpoint is consistent with an input-handling defect in request parsing or session state - likely a malformed-message handler that can exhaust a worker, corrupt in-memory state, or write unintended values to a subset of OEM-accessible data. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform covering releases 13.5 and 24.1.

RemediationAI

Apply the patches delivered in Oracle's June 2026 Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspujun2026.html, which is the vendor-released fix track for OEM 13.5 and 24.1 - note exact patched build numbers must be taken from the CPU document itself rather than inferred. Until the CPU is staged, restrict network reachability of the OMS HTTPS endpoints (default 7799/7802 for Agent Next Gen and 7803 for the console upload port) to only the management VLAN and known agent hosts via firewall or security-list ACLs, accepting the trade-off that agents on unlisted networks will lose communication until they are re-homed. Place the OMS behind a reverse proxy or load balancer that enforces strict TLS client validation if mutual TLS is configured, and disable any unused HTTPS upload endpoints in emagent.properties; these controls reduce exposure but do not eliminate the flaw and should be treated as bridging measures, not substitutes for the CPU patch.