This vulnerability (CVE-2026-47006) affects the Oracle Enterprise Manager Base Platform's Self Update Framework component in versions 13.5 and 24.1. It allows a high privileged attacker with network access over HTTPS to compromise the platform, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific vulnerability. Customers are strongly advised to apply all relevant patches promptly to mitigate risks.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access via HTTPS to take over the platform, potentially affecting management and monitoring capabilities dependent on this product.

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches without delay. Although no explicit patch or remediation level is stated for CVE-2026-47006, customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. Maintaining up-to-date patched versions is the primary mitigation. No vendor advisory states that no action is required or that the issue is already mitigated.