CVE-2026-46865

{"id": "CVE-2026-46865", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46865", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Enterprise Manager Base Platform", "versions": [{"status": "affected", "version": "13.5", "versionType": "semver"}, {"status": "affected", "version": "24.1", "versionType": "semver"}]}]}], "published": "2026-06-17T10:54:04.170", "references": [{"url": "https://www.oracle.com/security-alerts/cspujun2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Enterprise Manager Base Platform de Oracle Enterprise Manager (componente: Extensibility Framework). Versiones soportadas que est\u00e1n afectadas son 13.5 y 24.1. Vulnerabilidad f\u00e1cilmente explotable permite a un atacante con altos privilegios con inicio de sesi\u00f3n en la infraestructura donde se ejecuta Oracle Enterprise Manager Base Platform comprometer Oracle Enterprise Manager Base Platform. Aunque la vulnerabilidad est\u00e1 en Oracle Enterprise Manager Base Platform, los ataques pueden impactar significativamente productos adicionales (cambio de alcance). Ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Enterprise Manager Base Platform. Puntuaci\u00f3n Base CVSS 3.1 8.2 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E8758C8-87D3-450A-878B-86CE8C9FC140"}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DBBDACA-3980-40BA-8B4C-B554F37CF138"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}