CVE-2026-46984 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Agent Next Gen component and affects specifically versions 13.5 and 24.1. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who have network access through the HTTPS protocol. The CVSS base score of 5.3 indicates a medium severity vulnerability with confidentiality impacts, as reflected in the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability's ease of exploitation means that attackers can potentially compromise the system without requiring any authentication credentials or prior access privileges, making it particularly dangerous for organizations relying on this platform.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Agent Next Gen component, which allows unauthorized network connections to access sensitive data within the Oracle Enterprise Manager Base Platform. This weakness specifically enables unauthorized read access to a subset of accessible data, potentially exposing confidential information that should remain protected within the enterprise environment. The vulnerability operates at the network level and requires only HTTPS connectivity, eliminating the need for complex attack vectors or privileged access. Attackers can leverage this flaw by simply connecting to the affected system through standard HTTPS protocols without needing valid credentials or authentication tokens.
The operational impact of this vulnerability extends beyond simple data exposure, as it undermines the fundamental security posture of organizations using Oracle Enterprise Manager Base Platform. Successful exploitation could lead to unauthorized access to configuration data, monitoring information, and potentially sensitive operational details that are typically restricted to authorized personnel only. The subset of data accessible through this vulnerability suggests that while not all system information is compromised, enough sensitive data exists to pose meaningful risks to enterprise security. Organizations may experience regulatory compliance issues, competitive intelligence exposure, and potential downstream impacts on their operational integrity.
Organizations should implement immediate mitigations including network segmentation to restrict access to affected systems, deployment of firewall rules to limit HTTPS access to trusted networks only, and consideration of disabling unnecessary agent functionality until proper patches are applied. The vulnerability aligns with CWE-287 which addresses improper authentication issues in software systems, and represents a specific implementation weakness that could be categorized under ATT&CK technique T1190 for exploitation through external remote services. Regular security monitoring should be implemented to detect potential exploitation attempts, and organizations should closely monitor Oracle's security bulletins for patches addressing this specific vulnerability in the Agent Next Gen component of Oracle Enterprise Manager Base Platform.