CVE-2026-47002 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Enterprise Manager Base Platform's UI Framework component, representing a significant security weakness that affects versions 13.5 and 24.1 of the platform. The flaw constitutes an easily exploitable security gap that permits unauthenticated attackers to compromise the system through HTTPS network connections without requiring any prior authentication credentials. The vulnerability's classification as easily exploitable indicates that the attack vector is straightforward and accessible to threat actors with minimal technical expertise, while the requirement for human interaction suggests that social engineering or user deception may be necessary to initiate the attack successfully.
The technical nature of this vulnerability stems from insufficient access controls within the UI Framework component, which allows unauthorized actors to gain elevated privileges through network-based attacks. The CVSS 3.1 base score of 6.1 reflects a medium severity threat that primarily impacts confidentiality and integrity aspects of the system, with a vector indicating network accessibility, low attack complexity, no privilege requirements, and required user interaction. This vulnerability demonstrates characteristics consistent with CWE-284 (Improper Access Control) and potentially CWE-352 (Cross-Site Request Forgery), as it enables unauthorized data manipulation through web-based interfaces.
The operational impact of this vulnerability extends beyond the immediate Oracle Enterprise Manager Base Platform, creating a scope change that can affect additional products within the enterprise environment. Successful exploitation enables attackers to perform unauthorized update, insert, or delete operations against sensitive platform data, while simultaneously providing read access to confidential information within the system's data repository. This dual impact on both integrity and confidentiality represents a significant risk to organizational security posture, particularly given that the vulnerability affects critical infrastructure management tools used for enterprise-wide monitoring and control.
Mitigation strategies should prioritize immediate patching of affected versions with Oracle's security updates, while implementing network segmentation to limit access to the vulnerable platform components. Organizations should enhance their monitoring capabilities to detect anomalous access patterns and unauthorized data manipulation attempts. Network-based controls including firewall rules and intrusion detection systems can help mitigate exploitation attempts by restricting access to the affected HTTPS endpoints. Additionally, implementing multi-factor authentication for administrative access and conducting regular security assessments of the UI Framework component will strengthen overall defensive measures. The vulnerability's requirement for human interaction suggests that user awareness training programs should be implemented to reduce the risk of social engineering attacks that could facilitate exploitation. This issue aligns with ATT&CK techniques related to privilege escalation and credential access, emphasizing the need for comprehensive security controls that address both technical and human factors in the attack chain.
The vulnerability's classification within the CVSS framework indicates that while it requires user interaction to initiate, the potential impact on organizational data integrity and confidentiality warrants immediate attention. Organizations should conduct thorough risk assessments to determine the full scope of affected systems and implement layered security controls that address the root cause through proper access control mechanisms, while maintaining continuous monitoring for any exploitation attempts.