External risk intelligence

Oracle Enterprise Manager Base Platform Vulnerability Allows Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-46856

A critical vulnerability in Oracle Enterprise Manager Base Platform, reachable via network access, can allow an unauthenticated attacker to take over the system after user interaction. This could significantly impact additional products.

Cross-site Scripting

Oracle Enterprise Manager Base Platform

13.5.0.024.1.0.0.0

Halo Surface Signal

Possible · external exposure

3Halo Surface Signal

Oracle Enterprise Manager is typically deployed within internal administrative network segments to manage enterprise infrastructure. While it is accessible via HTTP, it is rarely exposed directly to the public internet in standard deployments, though it is plausibly reachable in some specific enterprise configurations.

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Oracle Enterprise Manager Base Platform could allow an attacker to take control of the system. This issue is easily exploitable, requiring only network access and a user to interact with a malicious link or document. Successful exploitation could lead to a significant impact on additional products beyond the Enterprise Manager itself, as the vulnerability's scope can change.

  • Attacker can take over management systems.
  • Critical infrastructure management tool is at risk.
  • Confirm relevance and scope of exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can reach Oracle Enterprise Manager Base Platform over a network. By tricking a user into interacting with a specially crafted link, the attacker can trigger a vulnerability within the Metadata Plugin. This could lead to a complete takeover of the platform and potentially affect other connected products.

  • No authentication required for access.
  • Requires user interaction to trigger.
  • Allows full platform takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to compromise the Oracle Enterprise Manager Base Platform. Successful exploitation requires user interaction and could impact other products managed by the platform, potentially leading to a full takeover of the Oracle Enterprise Manager Base Platform.

  • Oracle Enterprise Manager Base Platform could be compromised.
  • An attacker could exploit it via network access.
  • Takeover of the platform is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Enterprise Manager Base Platform, specifically versions 13.5 and 24.1, has a critical vulnerability that could lead to a complete takeover of the platform. This issue is likely to fall under the responsibility of infrastructure or platform teams, with potential involvement from security teams for exposure assessment and vendor management if Oracle support is required for remediation. The immediate first step is to identify all instances of the affected product, confirm their reachability and business criticality, and then assign an owner for risk-based remediation planning.

  • Infrastructure or platform teams own resolution.
  • Verify exposure and business criticality first.
  • Plan remediation based on identified risk.

Supplementary metadata

PCI scan relevance

Yes

CVE-2026-46856 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This vulnerability in Oracle Enterprise Manager Base Platform allows an unauthenticated attacker to take over the system, which would likely cause a PCI ASV scan to fail.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Enterprise Manager Base Platform?

It is a central management framework used by organizations to monitor, administer, and automate complex IT environments. The Base Platform acts as the foundation for these operations, while specific components like the Metadata Plugin handle configuration and data storage tasks. It is essentially the command center for enterprise infrastructure, allowing administrators to oversee servers, databases, and applications from a single console.

What does CWE-79 mean for CVE-2026-46856?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). In the context of this CVE, it means the software does not properly filter data provided by users before displaying it. An attacker can exploit this weakness to inject malicious scripts into the platform, which then execute in the context of an unsuspecting user's browser session, potentially leading to unauthorized actions or a full system takeover.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker convinces an authenticated user to interact with a specially crafted link or document. Because it requires this human element, simply scanning the network is not enough to trigger the exploit. The bug is not triggered if users do not click on malicious links or interact with compromised content while logged into the platform.

Do I need to worry if my instance is internal?

Yes, you should still evaluate the risk. According to Halo Surface Signal, this software is typically kept on internal networks, meaning it is not usually exposed to the public internet. However, an attacker who has already breached another part of your internal network could use their access to reach the platform. Since it is reachable over HTTP, any segment with network connectivity to the management console remains a potential attack path.

What is the first step to address this threat?

Begin by creating an inventory of all your Oracle Enterprise Manager instances to confirm which servers are running the affected versions 13.5 and 24.1. Once identified, work with your infrastructure or platform teams to assess how critical these instances are to your operations. This ensures you can prioritize remediation efforts based on the specific risk the software poses to your unique environment.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished