NCSC-2026-0257 — Kwetsbaarheden verholpen in Oracle Enterprise Manager

Summary

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Enterprise Manager Base Platform versies 13.5 en 24.1.

Details

Interpretaties
De kwetsbaarheden in Oracle Enterprise Manager Base Platform stellen aanvallers in staat om via netwerktoegang over HTTPS of HTTP zonder authenticatie of met lage privileges ongeautoriseerde lees-, schrijf-, creatie-, verwijdering- en wijzigingsacties op gevoelige data uit te voeren. Sommige kwetsbaarheden maken het mogelijk om volledige systeemcompromittering te bereiken, waaronder het uitvoeren van willekeurige code en het overnemen van het systeem. Andere kwetsbaarheden kunnen leiden tot gedeeltelijke denial-of-service condities. De kwetsbaarheden zijn aanwezig in verschillende componenten van het platform, zoals Agent Next Gen, Metadata Plugin en UI Framework. Exploitatie kan vereisen dat de aanvaller netwerktoegang heeft en in enkele gevallen gebruikersinteractie. De kwetsbaarheden maken gebruik van onvoldoende toegangscontrole en onjuiste beveiligingsmaatregelen binnen het platform.

Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden in Oracle Enterprise Manager Base Platform te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 27

Critical 9.8

CVE-2020-9547 Public exploit Scanner template EPSS 18%

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 2, 2020
Critical 9.8

CVE-2026-46994

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Critical 9.1

CVE-2026-46989

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framew…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 8.8

CVE-2026-46992

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterpris…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 8.8

CVE-2026-46995

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 8.8

CVE-2026-46998

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 8.8

CVE-2026-47004

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Upda…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 8.2

CVE-2026-46993

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 8.1

CVE-2014-3643

jersey: XXE via parameter entities

jersey: XXE via parameter entities not disabled by the jersey SAX parser

jersey jersey com.sun.jersey:jersey-core Maven

Dec 15, 2019
High 7.7

CVE-2026-46987

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Applicati…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 7.3

CVE-2026-46990

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterpris…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 7.2

CVE-2026-46988

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 7.2

CVE-2026-47005

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Upda…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 7.2

CVE-2026-47006

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Upda…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 7.1

CVE-2026-46996

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
High 7.0

CVE-2026-46999

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 6.5

CVE-2026-46997

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 6.3

CVE-2025-68161

Apache Log4j Core: Missing TLS hostname verification in Socket appender

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven

Dec 18, 2025
Medium 6.3

CVE-2025-8916

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpk…

Legion of the Bouncy Castle BC-JAVA BCPKIX-FIPS druid Debian Ubuntu Wolfi Maven

Aug 13, 2025
Medium 6.1

CVE-2026-47002

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framew…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 5.9

CVE-2026-47003

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framew…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 5.4

CVE-2026-47001

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Web Servi…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 5.3

CVE-2026-46984

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 5.3

CVE-2026-46985

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 5.3

CVE-2026-46986

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Medium 4.4

CVE-2026-46991

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterpris…

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026
Low 3.5

CVE-2026-47000

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security …

Oracle Oracle Enterprise Manager Base Platform

Jul 21, 2026

Revision history

2026-07-22 #1.0.0
Initiele versie

References

Reference
https://www.oracle.com/security-alerts/cpujul2026.html
Reference
https://www.oracle.com/security-alerts/cpujul2026verbose.html

Kwetsbaarheden verholpen in Oracle Enterprise Manager

Summary

Details

Vulnerabilities 27

jackson-databind mishandles the interaction between serialization gadgets and typing

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framew…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterpris…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Upda…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

jersey: XXE via parameter entities

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Applicati…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterpris…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Upda…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Upda…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata …

Apache Log4j Core: Missing TLS hostname verification in Socket appender

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framew…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framew…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Web Servi…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterpris…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security …

Revision history

References