Oracle Enterprise Manager EUVD-2026-46479

Exploitation requires network HTTP access to the Oracle Enterprise Manager Base Platform OMS/console and specifically the Enterprise Config Management component, on affected versions 13.5 or 24.1. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions, credentials, or user interaction are needed - unauthenticated remote exploitation works against affected, network-reachable deployments. The primary limiting factor is reachability: OEM consoles are typically deployed on internal management networks, so exploitation depends on the attacker having a route to the OMS HTTP port; deployments that are network-segmented or not on 13.5/24.1 are not exposed. Impact is also inherently bounded to a subset of EM data plus partial DoS, not full compromise.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the most alarming signal: network reachable, low complexity, no privileges, and no user interaction, meaning any actor who can reach the OMS HTTP port can attempt exploitation. Impacts are limited (C:L/I:L/A:L, scope unchanged), so this is data tampering/partial disclosure and partial DoS, not full system compromise - which is why the score lands at 7.3 (High) rather than Critical. Countervailing signals: no EPSS score was provided, there is no POC in the supplied data, and the CVE is not in CISA KEV, so there is no evidence of active or automatable mass exploitation yet. Net: the exposure profile (unauthenticated, easy) makes it a genuine priority for any reachable EM deployment, but the bounded impact means it is data-integrity/availability risk rather than a full takeover - verify actual network exposure of the OMS before ranking it above Critical RCE issues.

An attacker who can reach the Oracle Management Service over HTTP - for example from a compromised internal host or a poorly segmented network - sends crafted requests to the Enterprise Config Management component without any credentials. Because the flaw requires no authentication and low complexity, they read a subset of configuration data and then insert, modify, or delete other EM-accessible records or trigger a partial denial of service, undermining the integrity of configuration and compliance data. No public exploit code was identified at time of analysis, so an attacker would need to develop the request themselves.