EUVD-2026-46487
GHSA-84qj-r5qq-3ccm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated network HTTPS reach (AV:N/PR:N) at low complexity, but a required action by another user (UI:R) and full takeover justify C/I/A:H with scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.
Technical ContextAI
Oracle Enterprise Manager (OEM) Base Platform is Oracle's centralized console for managing and monitoring databases, middleware, and engineered systems; the affected code resides in its Metadata Plugin component, which processes plugin metadata within the web-facing management tier. The CWE is listed as N/A, so the precise weakness class is unstated, but the combination of an unauthenticated HTTPS vector with a mandatory user-interaction requirement (UI:R) is characteristic of a client-side or request-forgery style vector - for example, tricking an authenticated operator into loading crafted content that the platform then processes with the victim's authority. The single affected CPE (cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform) confirms scope is limited to the OEM Base Platform product rather than the managed targets, though a compromised OEM console is a high-value pivot into every system it manages.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 as the primary remediation - patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs deliver product-specific patches for OEM 13.5 and 24.1, so apply the OEM Base Platform bundle corresponding to your installed version rather than an invented version number. Until patching, reduce exposure by restricting network access to the OEM management HTTPS interface to trusted administrative networks or a management VPN (trade-off: legitimate remote admins must route through the allowed network), and reinforce the user-interaction dependency by cautioning operators against following untrusted links or loading external content while authenticated to OEM, since UI:R means the attack cannot succeed without an operator action. Because this is a management plane, also monitor OEM administrative sessions and audit logs for anomalous plugin/metadata activity as a detective control while patching is scheduled.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today