Oracle Enterprise Manager Base Platform vulnerabilities

163 CVEs affecting Oracle Enterprise Manager Base Platform, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70684, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability, published 2018-08-22. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then:…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2019-0227, published 2019-05-01. High severity, CVSS 7.5. EPSS: 91.9% chance of exploitation in the next 30 days. A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2022-23305, published 2022-01-18. Critical severity, CVSS 9.8. EPSS: 66.5% chance of exploitation in the next 30 days. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is…
CVE-2021-34798, published 2021-09-16. High severity, CVSS 7.5. EPSS: 64.5% chance of exploitation in the next 30 days. Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2022-23302, published 2022-01-18. High severity, CVSS 8.8. EPSS: 63.6% chance of exploitation in the next 30 days. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP…
CVE-2021-36160, published 2021-09-16. High severity, CVSS 7.5. EPSS: 62.9% chance of exploitation in the next 30 days. A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

Latest

CVE-2026-70684, published 2026-08-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Difficult to…
CVE-2026-61300, published 2026-08-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily…
CVE-2026-61298, published 2026-08-18. Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install). Supported versions that are affected are 13.5 and 24.1.…
CVE-2026-61286, published 2026-08-18. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 and 24.1. Easily…
CVE-2026-61284, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console). Supported versions that are affected are 13.5 and 24.1.…
CVE-2026-47006, published 2026-07-21. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily…
CVE-2026-47005, published 2026-07-21. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily…
CVE-2026-47004, published 2026-07-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily…
CVE-2026-47003, published 2026-07-21. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to…
CVE-2026-47002, published 2026-07-21. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily…