CVE-2026-46991 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Enterprise Config Management component, representing a significant security weakness that can be exploited by attackers with minimal privileges. The affected versions 13.5 and 24.1 demonstrate that this flaw has persisted across multiple release cycles, indicating a fundamental design or implementation issue that requires immediate attention. The vulnerability's classification as easily exploitable suggests that the attack vector is straightforward and does not require sophisticated techniques, making it particularly dangerous in environments where attackers may already have some level of access to the target infrastructure.
The technical nature of this vulnerability stems from insufficient access controls within the Enterprise Config Management component, which allows a low-privileged attacker who has successfully logged into the system where Oracle Enterprise Manager Base Platform operates to gain unauthorized access to critical system functions. This flaw operates at a foundational level where proper authentication and authorization mechanisms fail to adequately protect sensitive data and operations. The vulnerability specifically enables attackers to perform unauthorized update, insert, or delete operations against certain portions of the platform's accessible data, while also providing unauthorized read access to additional data subsets, creating a dual threat to both data integrity and confidentiality.
From an operational impact perspective, this vulnerability creates a substantial risk for organizations relying on Oracle Enterprise Manager Base Platform for their enterprise management functions. The ability to modify configuration data or insert malicious entries can lead to system instability, unauthorized privilege escalation, or complete compromise of the managed environment. The unauthorized read access capability allows attackers to extract sensitive information that could be used for further attacks against other systems or to understand the organization's infrastructure better. This vulnerability essentially provides a backdoor for attackers to manipulate core configuration data while simultaneously enabling reconnaissance activities that can facilitate more sophisticated attacks.
The CVSS 3.1 score of 4.4 reflects the moderate severity of this vulnerability, with confidentiality and integrity impacts rated as low, indicating that while the attack is not extremely severe, it still represents a meaningful threat to system security. The vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N clearly demonstrates that the attack requires local access with low complexity and low privileges, while the unspecified scope suggests that the impact extends beyond the immediate platform boundaries. This vulnerability aligns with CWE-284 (Improper Access Control) which specifically addresses inadequate authorization mechanisms in software systems. The ATT&CK framework would categorize this under privilege escalation and defense evasion techniques, as attackers could leverage this vulnerability to maintain persistent access while avoiding detection through legitimate system operations.
Organizations should implement immediate mitigations including applying the latest Oracle patches and security updates, reviewing and strengthening access controls for the Enterprise Manager Base Platform, implementing network segmentation to limit local access privileges, and conducting thorough audits of configuration management processes. The principle of least privilege should be enforced more rigorously across all system components, while monitoring should be enhanced to detect unauthorized configuration changes that could indicate exploitation attempts. Regular security assessments of Oracle Enterprise Manager environments should include specific checks for similar access control vulnerabilities, and incident response procedures should be updated to address potential compromise scenarios involving configuration management systems.