cve-2026-46994
CRITICAL CVSS 9.8 opencve
Description
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Timeline
- Published
- 2026-07-21 22:17 UTC
- Last Modified
- 2026-07-24
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
mitre | ||
| 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd | ||
| 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
opencve |
References
No references available.
Linked Vulnerabilities
{
"cve": "CVE-2026-46994",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "13.5"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "24.1"
}
}
],
"enrichment": {
"confidence": 95.0,
"confidence_source": "inferred",
"scores": [
{
"score": 95.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Oracle Enterprise Manager Base Platform",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "enterprise_manager_base_platform",
"vendor": "oracle"
}
],
"created": "2026-07-23T08:00:06.820278+00:00",
"title": "Unauthenticated HTTPS Access Enables Platform Compromise in Oracle Enterprise Manager",
"updated": "2026-08-03T00:15:17.340183+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$enterprise_manager_base_platform"
]
},
"epss": {
"score": 0.00508
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1:*:*:*:*:*:*:*"
],
"created": "2026-07-21T21:32:55.793000+00:00",
"description": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 9.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/46xxx/CVE-2026-46994.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-07-23T13:47:27.963000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$enterprise_manager_base_platform"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1.0.0.0:*:*:*:*:*:*:*"
],
"created": "2026-07-21T22:17:04.663000+00:00",
"description": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 9.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-46994.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-07-24T19:03:42.750000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$enterprise_manager_base_platform"
],
"weaknesses": [
"CWE-284"
]
},
"opencve": {
"changes": [
{
"created": "2026-07-21T21:45:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$enterprise_manager_base_platform"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$enterprise_manager_base_platform"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 9.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "257496ae-95f3-46dd-afcf-2f967f0bfb46"
},
{
"created": "2026-07-23T14:30:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "71bc6357-f5f8-4f4e-8e9b-56ba1aa659b5"
},
{
"created": "2026-07-24T21:15:00+00:00",
"data": [
{
"details": {
"new": "Oracle Enterprise Manager Base Platform: Unauthenticated HTTPS Agent Vulnerability",
"old": null
},
"type": "title"
}
],
"id": "1ca5e5ff-9ccb-437f-a6bf-916a36d92316"
},
{
"created": "2026-07-29T00:00:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Oracle Enterprise Manager Base Platform: Unauthenticated HTTPS Agent Vulnerability"
},
"type": "title"
}
],
"id": "f783ef12-e46d-410c-bfa2-00b94f2da2de"
},
{
"created": "2026-08-03T00:30:00+00:00",
"data": [
{
"details": {
"new": "Unauthenticated HTTPS Access Enables Platform Compromise in Oracle Enterprise Manager",
"old": null
},
"type": "title"
}
],
"id": "125aa7a4-8259-4b9a-ab1f-62d3eaf54bef"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1.0.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-07-21T21:32:55.793000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 9.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00508
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": "Unauthenticated HTTPS Access Enables Platform Compromise in Oracle Enterprise Manager",
"provider": "enrichment"
},
"updated": {
"data": "2026-08-03T00:15:17.340183+00:00",
"provider": "enrichment"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$enterprise_manager_base_platform"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-284"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-07-21T21:32:55.793000+00:00",
"description": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-07-23T13:47:09.920000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/46xxx/CVE-2026-46994.json",
"weaknesses": [
"CWE-284"
]
}
}
Enrichment data
Aggregated bundle (all enrichments)