CVE-2026-46990 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Enterprise Config Management component, representing a critical security weakness that affects versions 13.5 and 24.1. The flaw manifests as an insufficient authentication mechanism that permits unauthenticated remote attackers to exploit the system through standard HTTP network connections. The CVSS 3.1 scoring of 7.3 indicates a high-severity threat with impacts across confidentiality, integrity, and availability domains, demonstrating the comprehensive nature of potential compromise.
The technical implementation of this vulnerability stems from inadequate access controls within the web-based management interface, allowing malicious actors to bypass authentication requirements entirely. Attackers can leverage this weakness to perform unauthorized operations including data modification, deletion, and insertion activities against sensitive configuration data managed by the platform. Additionally, the vulnerability enables read access to restricted datasets, potentially exposing confidential operational information about enterprise systems under management.
The operational impact of this vulnerability extends beyond simple data compromise to include partial denial of service conditions that can disrupt normal platform operations. Successful exploitation allows attackers to manipulate critical configuration settings which may result in system instability or reduced functionality. The partial DOS capability represents a significant concern for enterprise environments where continuous availability of monitoring and management capabilities is essential for operational continuity.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-287 (Improper Authentication) and maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing). Organizations should implement immediate mitigations including network segmentation to restrict access to the affected platform, deployment of web application firewalls to filter suspicious HTTP requests, and implementation of strong authentication mechanisms. The vulnerability demonstrates the importance of maintaining up-to-date security patches and implementing principle of least privilege access controls for management interfaces.
Mitigation strategies should include disabling unnecessary HTTP access to the platform, implementing robust network monitoring to detect anomalous access patterns, and conducting comprehensive security assessments of all management interfaces. Regular vulnerability scanning and penetration testing can help identify similar authentication weaknesses across the enterprise infrastructure. The affected versions require immediate patching through Oracle's official security updates to remediate this vulnerability and prevent exploitation by threat actors targeting enterprise management platforms.