What is the CVSS score of EUVD-2026-46475?

EUVD-2026-46475 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Enterprise Manager EUVD-2026-46475

| CVE-2026-46986 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-mggp-6h69-c495

Authentication Bypass Oracle Oracle Enterprise Manager Base Platform Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible HTTPS endpoint with no authentication barrier (PR:N, AC:L); only partial confidentiality read impact confirmed, no integrity or availability effect, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:01 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows remote attackers to read a subset of accessible platform data via the Agent Next Gen component over HTTPS without credentials. Tagged as an Authentication Bypass, this network-accessible flaw carries a low-complexity attack profile (AV:N/AC:L/PR:N/UI:N), meaning any network-reachable adversary can exploit it with minimal effort. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the absence of authentication requirements and zero attack complexity make this straightforward to operationalize, particularly given that OEM manages critical enterprise infrastructure.

Technical ContextAI

Oracle Enterprise Manager Base Platform is Oracle's flagship enterprise IT management suite, used to monitor databases, middleware, and hosts at scale. The affected component, Agent Next Gen, is the next-generation monitoring agent responsible for telemetry collection and communication between managed targets and the OEM Management Service (OMS) over HTTPS. The CPE identifier (cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform) confirms vendor-scoped impact. No CWE is formally assigned by Oracle, which is consistent with Oracle's standard CPU disclosure practice, but the 'Authentication Bypass' tag in the intelligence data strongly suggests the root cause is an unauthenticated endpoint or API path within the Agent Next Gen component that fails to enforce access controls before returning platform-accessible data. The HTTPS transport does not substitute for application-layer authentication here.

RemediationAI

Apply the patches provided in Oracle's July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. The exact patched release version is not independently confirmed beyond the advisory reference and must be verified directly from the Oracle CPU document. If immediate patching is not feasible, restrict network access to the OEM Agent Next Gen HTTPS endpoints using firewall or network ACL rules, scoping permitted source addresses to authorized OEM Management Service hosts and administrator workstations only - this directly targets the AV:N attack vector. Note that overly broad HTTPS blocking will disrupt legitimate agent-to-OMS communication, so rules should be narrowly scoped to management subnets rather than blanket-blocking port 443. Monitoring HTTPS access logs for unexpected unauthenticated requests to Agent Next Gen API paths can also serve as a compensating detective control while patching is underway.