CVE-2026-46998 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Metadata Plugin component, representing a critical security flaw that affects versions 13.5 and 24.1 of the enterprise management platform. The vulnerability operates as an easily exploitable attack vector that permits unauthenticated remote attackers to compromise the target system through HTTPS network connections without requiring any authentication credentials or privileged access. The CVSS 3.1 scoring system rates this vulnerability with a base score of 8.8, indicating high severity across all three core security principles: confidentiality, integrity, and availability. This classification places the vulnerability in the critical severity category under the Common Weakness Enumeration framework, specifically aligning with CWE-287 which addresses improper authentication mechanisms that allow unauthorized access to system resources.
The technical exploitation of this vulnerability requires a specific operational condition where human interaction from an individual other than the attacker is necessary for successful compromise. This characteristic suggests that while the attack itself can be executed remotely without authentication, it likely involves some form of social engineering or user manipulation component that makes the attack more sophisticated than simple automated exploitation. The attack vector operates over HTTPS protocol, indicating that attackers can leverage existing network connectivity to reach vulnerable systems without needing physical access or specialized network privileges.
The operational impact of this vulnerability is severe and potentially devastating for organizations relying on Oracle Enterprise Manager Base Platform for their enterprise management operations. Successful exploitation results in complete takeover of the target platform, which would provide attackers with full administrative control over the management infrastructure. This level of compromise enables unauthorized users to manipulate system configurations, access sensitive data managed by the platform, disrupt services, and potentially use the compromised platform as a launch point for further attacks within the network environment. The confidentiality impact is rated high because attackers can access sensitive information stored within the management platform, while integrity and availability impacts are equally severe as attackers can modify critical system configurations and potentially cause service disruptions.
Organizations affected by this vulnerability should prioritize immediate remediation through official Oracle security patches and updates released for versions 13.5 and 24.1 of Enterprise Manager Base Platform. Network segmentation strategies should be implemented to limit access to the vulnerable platform, while monitoring systems should be deployed to detect anomalous network traffic patterns that might indicate exploitation attempts. The vulnerability's classification under ATT&CK framework would likely map to techniques involving privilege escalation and persistence mechanisms, as attackers who successfully compromise the platform could establish long-term access and maintain control over enterprise management infrastructure. Security teams should also consider implementing additional authentication controls and access monitoring for the metadata plugin component to detect unauthorized access attempts even before patching occurs.
The vulnerability demonstrates a significant gap in Oracle's security architecture related to authentication and authorization controls within the Metadata Plugin component, highlighting the importance of comprehensive security testing and vulnerability assessments for enterprise management platforms. Organizations should conduct thorough risk assessments to determine the attack surface exposure and implement layered defense strategies that include network monitoring, access control reviews, and regular security patching procedures. The requirement for human interaction suggests potential integration with social engineering tactics that security teams must consider when developing their overall defensive strategies against such sophisticated attack vectors.