CVE-2026-46875: Critical severity Oracle Enterprise Manager Base Platform vulnerability
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Oracle Enterprise Manager Base Platform HTTPS management interface to trusted IPs only using firewalls, network ACLs, VPN access, or place the interface behind a WAF. Block or limit public/unauthenticated HTTPS access to the management endpoints.
- Operational
Monitor and review Oracle Enterprise Manager logs and events for suspicious activity. If compromise is suspected or confirmed (successful takeover), assume high-privilege account exposure: rotate credentials for all high-privilege accounts, restore affected systems from known-good backups, and perform incident response containment and remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46875?
The severity of CVE-2026-46875 is critical with a CVSS score of 9.1.
How do I fix CVE-2026-46875?
To fix CVE-2026-46875, apply the latest patches provided by Oracle for the affected versions.
Which versions are affected by CVE-2026-46875?
CVE-2026-46875 affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1.
Who is at risk from CVE-2026-46875?
A high privileged attacker with network access via HTTPS is at risk of exploiting CVE-2026-46875.
What type of attacks can be conducted with CVE-2026-46875?
CVE-2026-46875 allows attackers to compromise Oracle Enterprise Manager due to its easily exploitable nature.