Oracle Enterprise Manager EUVD-2026-46482

Exploitation requires a valid low-privilege OEM account (PR:L) with HTTPS network access to the Oracle Enterprise Manager Base Platform Agent Next Gen interface; it targets supported versions 13.5 and 24.1 specifically. No user interaction is needed (UI:N), but the high attack complexity (AC:H) means success depends on additional conditions the attacker does not control - such as specific timing, configuration state, or environmental factors in the agent-to-OMS trust flow - which meaningfully limit reliable exploitation. Availability is not affected (A:N). The limiting factors are therefore the prerequisite authenticated foothold and the non-trivial exploitation complexity, not open unauthenticated access.

Signals are moderately elevated but not emergency-tier. The CVSS 3.1 base score is 8.2 (High), driven largely by the scope change (S:C) and full Confidentiality/Integrity impact (C:H/I:H), while Availability is untouched (A:N). Critically, AC:H (high attack complexity) and PR:L (attacker must already hold some valid low-privilege access) meaningfully raise the bar - this is not trivially mass-exploitable. No EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or automatable exploitation; the risk is 'privileged insider or foothold-holder escalates and pivots' rather than 'internet-wide unauthenticated scanning.' The 'Authentication Bypass' tag conflicts somewhat with the PR:L vector (which implies the attacker is already authenticated) - verify with Oracle whether the bypass concerns lateral trust between agent and OMS rather than initial login. Net: a genuine priority for organizations running OEM as a crown-jewel management plane, but the AC:H + PR:L combination places it below any unauthenticated RCE.

An attacker who has obtained a low-privileged OEM account (e.g., via phishing, credential reuse, or an over-provisioned service account) reaches the Agent Next Gen HTTPS interface and abuses the trust/authorization weakness to read and alter data across the management platform. Because the flaw carries a scope change, the attacker leverages the central OMS's trust to reach data in other managed Oracle products beyond EM itself. No public POC is available, and the high attack complexity means the attacker must satisfy specific timing or environmental conditions to succeed.