CVE-2026-46856

🎯 CVE-2026-46856 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-46856 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Ent

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Klassifikation & Betroffenheit:

CWE-79 Oracle Corporation Oracle Enterprise Manager Base Platform 13.5Oracle Enterprise Manager Base Platform 24.1oracle enterprise_manager_base_platform 13.5.0.0oracle enterprise_manager_base_platform 24.1.0.0.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 🎯 High

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-63 · Cross-Site Scripting (XSS) (Very High) CAPEC-85 · AJAX Footprinting (Low) CAPEC-209 · XSS Using MIME Type Mismatch (Medium) CAPEC-588 · DOM-Based XSS (Very High) CAPEC-591 · Reflected XSS (Very High) CAPEC-592 · Stored XSS (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-91299 10.0 CVE-2026-106102 10.0 CVE-2026-87230 10.0 CVE-2026-83099 10.0 CVE-2026-83059 10.0

🇩🇪 BSI-Sicherheitshinweise: BSI · hoch · Oracle Enterprise Manager: Mehrere Schwachstellen ↗

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 www.oracle.com/security-alerts/cspujun2026.html

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 06/2026

Heute 21.10.

CVSS-Vektor-Analyse: 9.6

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Erforderlich

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CNA-Bewertung (oracle): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Veröffentlicht:17.06.2026

Aktualisiert:18.06.2026 04:16

Assigner (CNA):oracle

EUVD-ID:EUVD-2026-37349

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-79 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	726	0,2 %
≥50 %	3.223	0,9 %
≥10 %	22.086	5,9 %
<10 %	346.410	93,0 %

Tier

CVEs

Anteil

≥90 %

726

0,2 %

≥50 %

3.223

0,9 %

≥10 %

22.086

5,9 %

<10 %

346.410

93,0 %

Noch keine Analyse zu CVE-2026-46856

Beitrag zu CVE-2026-46856 verfassen

Zero-Day & Vulnerability Intelligence Hub