Enterprise Manager Base Platform vulnerabilities

39 known vulnerabilities in Enterprise Manager Base Platform from Oracle. 39 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-70684Aug 18, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with netwo

• 7.8 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-61300Aug 18, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to

• 8.6 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-61286Aug 18, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with netwo

• 8.8 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-61284Aug 18, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker w

• 7.2 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-47006Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with

• 7.2 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-47005Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with

• 8.8 High severity

  Oracle Enterprise Manager Base Platform: Missing Authentication for Critical Functionality

  CVE-2026-47004Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with n

• 7.0 High severity

  Oracle Enterprise Manager Base Platform: Missing Authentication for Critical Functionality

  CVE-2026-46999Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with

• 8.8 High severity

  Oracle Enterprise Manager Base Platform: URL Redirection to Untrusted Site

  CVE-2026-46998Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 7.1 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46996Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network

• 8.8 High severity

  Oracle Enterprise Manager Base Platform: Improper Privilege Management

  CVE-2026-46995Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network

• 9.8 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46994Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.2 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46993Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with networ

• 8.8 High severity

  Oracle Enterprise Manager Base Platform: Missing Authentication for Critical Functionality

  CVE-2026-46992Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker

• 7.3 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46990Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacke

• 9.1 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46989Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network ac

• 7.2 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46988Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with ne

• 7.7 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46987Jul 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attack

• 9.1 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46875Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with net

• 9.0 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46872Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Install). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access

• 7.2 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46868Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker wit

• 7.2 High severity

  Oracle Enterprise Manager Base Platform: Improper Privilege Management

  CVE-2026-46867Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker wit

• 8.2 High severity

  Oracle Enterprise Manager Base Platform: Uncontrolled Resource Consumption

  CVE-2026-46866Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.2 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46865Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker wit

• 8.8 High severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46864Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network

• 9.8 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46857Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker w

• 9.6 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Neutralization of Input During Web Page Generation

  CVE-2026-46856Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 9.9 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46855Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network

• 9.9 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46854Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Target Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with netwo

• 9.6 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Neutralization of Input During Web Page Generation

  CVE-2026-46853Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 9.9 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Privilege Management

  CVE-2026-46852Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network

• 9.9 Critical severity

  Oracle Enterprise Manager Base Platform: Improper Access Control

  CVE-2026-46832Jun 17, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with net

• 9.1 Critical severity

  Oracle Enterprise Manager Base Platform: Missing Authentication for Critical Functionality

  CVE-2026-34279Apr 21, 2026Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with netwo

• 8.8 High severity

  Enterprise Manager Base Platform: Improper Access Control

  CVE-2024-21067Apr 16, 2024Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). The supported version that is affected is 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to th

• 8.3 High severity

  Enterprise Manager Base Platform: Improper Access Control

  CVE-2024-20916Jan 16, 2024Oracle

  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). The supported version that is affected is 13.5.0.0. Easily exploitable vulnerability allows high privileged attacker with access to

• 8.8 High severity

  Apache Log4j 1.x: Deserialization of Untrusted Data

  CVE-2022-23307Jan 18, 2022ApacheEPSS 54.4%

  CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

• 9.8 Critical severity

  Apache Log4j 1.x: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-23305Jan 18, 2022ApacheEPSS 66.5%

  By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate

• 8.8 High severity

  Apache Log4j 1.x: Deserialization of Untrusted Data

  CVE-2022-23302Jan 18, 2022ApacheEPSS 63.8%

  JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Topi

• 8.1 High severity

  Apache Struts Remote Code Execution Exploited

  CVE-2018-11776Aug 22, 2018ApacheEPSS 100%

  Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its uppe