CVE-2026-46992 in Enterprise Manager Base Platform
Summary
by MITRE • 07/21/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Enterprise Config Management component, representing a critical security flaw that affects versions 13.5 and 24.1. The vulnerability operates as an easily exploitable weakness that permits low-privileged attackers to compromise the platform through HTTPS network connections. The CVSS 3.1 scoring system assigns this vulnerability a base score of 8.8, indicating high severity across all three core security principles: confidentiality, integrity, and availability. This classification places the vulnerability in the critical category according to industry standards and demonstrates its potential for significant operational damage.
The technical nature of this flaw involves insufficient authorization controls within the Enterprise Config Management component, allowing unauthorized users with minimal privileges to escalate their access and gain complete control over the Oracle Enterprise Manager Base Platform. The attack vector requires only network connectivity via HTTPS, eliminating the need for physical access or complex exploitation techniques that would typically be required for similar vulnerabilities. This accessibility factor significantly increases the attack surface and makes the vulnerability particularly dangerous in environments where network exposure is common.
The operational impact of successful exploitation extends beyond simple unauthorized access to encompass complete system compromise. An attacker who successfully exploits this vulnerability can achieve full control over the Oracle Enterprise Manager Base Platform, potentially gaining access to sensitive configuration data, administrative functions, and underlying infrastructure management capabilities. The high confidentiality, integrity, and availability impacts reflect the comprehensive nature of the compromise, where attackers could modify system configurations, exfiltrate confidential information, or disrupt service availability entirely.
Organizations affected by this vulnerability should prioritize immediate remediation through official Oracle patches and updates, as recommended in the Common Weakness Enumeration (CWE) catalog for similar authorization bypass flaws. The MITRE ATT&CK framework would categorize this vulnerability under privilege escalation techniques, specifically targeting the enterprise management platform components. Security teams should implement network segmentation controls, monitor for unusual access patterns, and conduct comprehensive vulnerability assessments to identify any potential exploitation attempts. Additionally, organizations should review their access control policies and ensure proper principle of least privilege implementation to minimize the impact of such vulnerabilities in their operational environments.