Description
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Published: 2026-06-16
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in the Metadata Plugin component of Oracle Enterprise Manager Base Platform permits an unauthenticated attacker with network access via HTTP to compromise the platform. The flaw can lead to full control over the affected system, affecting confidentiality, integrity, and availability of the platform.

Affected Systems

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are subject to the vulnerability. These releases should be verified for available security updates or upgraded to a version that includes the fix.

Risk and Exploitability

The CVSS 3.1 base score of 9.6 classifies the error as critical. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers gain access over the network without credentials via HTTP, but successful exploitation requires human interaction from a user other than the attacker, which limits the potential for fully automated attacks.

Generated by OpenCVE AI on August 13, 2026 at 20:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Enterprise Manager Base Platform security patch or upgrade to the most recent supported version that contains the fix.
  • If an upgrade cannot be performed immediately, restrict external HTTP access to the Metadata Plugin by configuring firewall or web‑application‑firewall rules to block unauthenticated requests to the affected endpoints.
  • Continuously monitor audit and security logs for anomalous access attempts to the Metadata Plugin, and investigate any suspected exploitation activity promptly.

Generated by OpenCVE AI on August 13, 2026 at 20:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Allows Platform Takeover in Oracle Enterprise Manager Base Platform

Thu, 18 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access to Metadata Plugin Allows Platform Takeover

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access to Metadata Plugin Allows Platform Takeover
Weaknesses CWE-79
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 16 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle enterprise Manager Base Platform
CPEs cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle enterprise Manager Base Platform
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Enterprise Manager Base Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-06-18T03:56:29.217Z

Reserved: 2026-05-18T15:55:10.307Z

Link: CVE-2026-46856

cve-icon Vulnrichment

Updated: 2026-06-17T14:35:25.973Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-17T10:54:03.220

Modified: 2026-06-18T04:16:49.747

Link: CVE-2026-46856

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T20:15:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • NVD-CWE-noinfo