This vulnerability (CVE-2026-47000) affects Oracle Enterprise Manager Base Platform version 24.1, specifically its Security Framework component. It permits a low privileged attacker with network access over HTTPS to perform unauthorized modifications (update, insert, delete) on accessible data, contingent on user interaction from a third party. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, and required user interaction, with an integrity impact but no confidentiality or availability impact. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery). The vendor advisory does not explicitly confirm a patch or remediation status for this specific vulnerability but references a Critical Patch Update containing multiple patches. Users are advised to stay current with Oracle patches.

The vulnerability allows unauthorized modification of some accessible data within Oracle Enterprise Manager Base Platform 24.1 by a low privileged attacker with network access via HTTPS, requiring user interaction. The impact is limited to integrity (unauthorized update, insert, or delete actions) without affecting confidentiality or availability. The CVSS score of 3.5 reflects low severity.

The vendor advisory does not explicitly state a patch or remediation for CVE-2026-47000. Oracle recommends applying Critical Patch Updates promptly to address security vulnerabilities. Users should monitor Oracle's official security alerts and apply relevant patches when available. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.