CVE-2026-47001 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Web Services Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Web Services Framework component, representing a significant security weakness that affects versions 13.5 and 24.1 of the enterprise management platform. The flaw operates as an easily exploitable entry point that requires minimal privileges from attackers who can establish network connections through HTTPS protocols. The vulnerability's classification as low privilege access means that even users with limited authentication credentials could potentially leverage this weakness to gain unauthorized access to critical system resources.
The technical nature of this flaw stems from inadequate authorization controls within the web services framework, allowing malicious actors to perform unauthorized data manipulation operations including updates, inserts, and deletes on specific portions of the platform's accessible data repositories. Additionally, the vulnerability enables unauthorized read access to subsets of data that should remain protected, creating a dual threat to both data integrity and confidentiality. This represents a direct violation of fundamental security principles where proper access controls fail to enforce data protection boundaries.
From an operational perspective, the impact of this vulnerability extends beyond simple data exposure to encompass potential system compromise through modification of critical management configurations. The CVSS 3.1 base score of 5.4 indicates a medium severity threat that could result in significant business disruption if exploited by adversaries seeking to manipulate enterprise management data or extract sensitive information from the platform's database systems. The attack vector requiring only network access via HTTPS makes this vulnerability particularly concerning as it can be exploited from remote locations without requiring physical presence or elevated privileges.
The vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) in its exploitation patterns, as attackers could potentially use compromised credentials to leverage this weakness. Organizations utilizing Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 face substantial risk of unauthorized data manipulation and information disclosure. The lack of user interaction requirements (UI:N) and low attack complexity (AC:L) make this vulnerability particularly dangerous as it can be exploited automatically without requiring extensive technical knowledge or interactive user participation.
Organizations should immediately implement mitigation strategies including applying Oracle's security patches, reviewing and strengthening access controls within the web services framework, and implementing network segmentation to limit exposure. Additional measures should include monitoring for unauthorized access attempts, conducting comprehensive vulnerability assessments of the affected platform versions, and establishing enhanced logging mechanisms to detect potential exploitation attempts. The combination of confidentiality and integrity impacts (C:L/I:L) underscores the necessity for immediate remediation to prevent potential data breaches that could compromise enterprise management operations and sensitive business information stored within the Oracle Enterprise Manager environment.