Oracle Enterprise Manager EUVD-2026-46492

Exploitation requires unauthenticated network access to the Oracle Enterprise Manager Base Platform HTTPS management interface (typically deployed on internal management networks, but exposure depends on organizational network segmentation). The AC:H metric indicates a specific precondition must be met; Oracle does not disclose its nature in the public CPU advisory, but the Authentication Bypass tag suggests a flaw in the UI Framework's request validation or session handling for specific endpoint paths or request structures. Exploitation is limited by: the undisclosed AC:H precondition, which raises the bar for opportunistic exploitation; the absence of any integrity or availability impact, meaning successful exploitation results only in unauthorized data read; and typical OEM deployment practice of restricting console access to internal management networks, which reduces external attack surface. The specific AC:H condition is unknown - this is the primary intelligence gap that defenders cannot currently mitigate through configuration.

The vendor-assigned CVSS 3.1 score of 5.9 (Medium) is driven by the High Attack Complexity (AC:H), which substantially reduces the exploitability probability relative to simpler network flaws. The unauthenticated network vector (AV:N/PR:N) combined with no required user interaction (UI:N) means no credentials or victim cooperation are needed if the attacker satisfies the AC:H precondition - Oracle does not disclose what that precondition is, which is a known intelligence gap. The confidentiality impact is High (C:H) with no integrity or availability impact, constraining the attack outcome to data theft. In practice, OEM manages credentials and configuration for monitored Oracle targets, meaning data exposure here can cascade into broader infrastructure compromise. EPSS data is not available in this dataset. There is no CISA KEV listing and no public exploit code identified. The Authentication Bypass tag warrants attention: bypass flaws can sometimes be easier to exploit in practice than AC:H implies, and this gap between the tag and the CVSS metric should be monitored for updated scoring or POC emergence. Overall, real-world risk is moderate but elevated in environments where the OEM console is exposed beyond a restricted management network.

An unauthenticated attacker with HTTPS access to the OEM console identifies and satisfies the high-complexity precondition in the UI Framework - such as a specific malformed request sequence or timing-dependent state - triggering the authentication bypass. The attacker then issues subsequent requests that are processed as if authenticated, extracting OEM-managed secrets such as monitored target credentials, database connection strings, and infrastructure configuration. No public exploit code has been identified, making this scenario most plausible for targeted attacks by sophisticated actors with prior reconnaissance of the OEM deployment rather than opportunistic scanning.