EUVD-2026-46491
GHSA-jrvq-63cf-mjmh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Matches vendor-provided vector; UI:R and S:C confirm browser-context execution with scope change, PR:N consistent with no attacker authentication needed.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
AnalysisAI
Cross-site scripting or session-hijacking class vulnerability in Oracle Enterprise Manager Base Platform's UI Framework component exposes versions 13.5 and 24.1 to unauthorized data access and manipulation via HTTPS. An unauthenticated remote attacker can exploit this with no privilege prerequisite, but requires a victim user to interact with attacker-controlled content, after which the attack scope extends beyond the directly targeted component. Successful exploitation yields limited unauthorized read and write access to Enterprise Manager data. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The affected component is the UI Framework layer of Oracle Enterprise Manager Base Platform, the primary web-based management console for Oracle environments. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is structurally consistent with a reflected or stored cross-site scripting (XSS) vulnerability: network-delivered via HTTPS, requiring victim interaction, with a scope change indicating the attacker's payload executes in the context of the victim's browser rather than the server itself. The tag 'Authentication Bypass' suggests that successful exploitation may enable session token theft or context manipulation that effectively bypasses authentication controls. Oracle did not disclose a specific CWE, so the precise root cause class - whether improper output encoding, improper neutralization of user input, or CSRF - cannot be confirmed from available data. Affected CPE: cpe:2.3:a:oracle_corporation:oracle_enterprise_manager_base_platform:*:*:*:*:*:*:*:* for versions 13.5 and 24.1.
RemediationAI
Apply the patches released in Oracle's Critical Patch Update for July 2026, available via the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish individual patched version numbers externally, so organizations should consult My Oracle Support for the specific patch bundle applicable to versions 13.5 and 24.1. As an interim compensating control, restrict access to the Oracle Enterprise Manager web console to trusted internal networks or VPN - preventing unauthenticated external parties from delivering the initial payload. Additionally, enforce strict Content Security Policy (CSP) headers at the reverse proxy or WAF layer to limit JavaScript execution from unintended sources, which reduces the impact of XSS-class flaws. Training EM administrators to treat unsolicited links referencing the EM UI as suspect reduces the UI:R attack vector. Note that network restriction does not eliminate risk from insider or phishing scenarios, so patching remains the authoritative remediation.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today