Description
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Self Update Framework component of Oracle Enterprise Manager Base Platform allows a high privileged attacker with network access via HTTPS to compromise the platform. This can lead to full takeover, jeopardising confidentiality, integrity and availability of all managed resources. The weakness is a direct authorization bypass.

Affected Systems

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are affected. Organizations using either release should verify their installation and assess whether the Self Update Framework is exposed to the network.

Risk and Exploitability

The CVSS score of 7.2 marks this as high severity. The EPSS value is listed as <1%, indicating a low but non-zero exploitation probability. It is not currently referenced in the CISA KEV catalog. The likely attack path requires remote HTTPS connectivity to the Self Update Framework endpoint and a user account with high privileges, allowing the attacker to take control of the platform process.

Generated by OpenCVE AI on August 5, 2026 at 02:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Oracle patch for Enterprise Manager Base Platform 13.5 or 24.1 that addresses the Self Update Framework flaw.
  • Configure access control to restrict HTTPS traffic to the Self Update Framework endpoint to trusted hosts only, limiting exposure to the privileged attacker profile.
  • If the Self Update Framework is not required, disable or uninstall the component to eliminate the attack vector.

Generated by OpenCVE AI on August 5, 2026 at 02:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Enterprise Manager Self Update Framework

Thu, 30 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Enterprise Manager Self Update Framework

Mon, 27 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Oracle Enterprise Manager Self‑Update Vulnerability Enables Remote Code Execution
Weaknesses CWE-264
CWE-862

Fri, 24 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Oracle Enterprise Manager Self‑Update Vulnerability Enables Remote Code Execution
Weaknesses CWE-264
CWE-862

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle enterprise Manager Base Platform
CPEs cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle enterprise Manager Base Platform
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Enterprise Manager Base Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T14:51:42.109Z

Reserved: 2026-05-18T15:55:10.316Z

Link: CVE-2026-47006

cve-icon Vulnrichment

Updated: 2026-07-23T14:50:12.233Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T02:15:03Z

Weaknesses