CVE-2026-46986 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Agent Next Gen component, representing a significant security weakness that affects versions 13.5 and 24.1 of the platform. The flaw manifests as an authentication bypass opportunity that operates over HTTPS protocol, creating a pathway for unauthorized network-based attackers to gain access to sensitive data within the enterprise management system. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise or resources to leverage this weakness effectively, making it particularly concerning for organizations relying on Oracle's enterprise management infrastructure.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Agent Next Gen component, allowing unauthenticated users to establish connections and potentially access restricted data within the Oracle Enterprise Manager environment. According to CVSS 3.1 scoring methodology, this vulnerability carries a base score of 5.3 which reflects low attack complexity but significant confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network-based attack surface with low access complexity, no privilege requirements, and no user interaction needed, while the limited impact on integrity and availability suggests the primary concern remains data confidentiality compromise.
The operational impact of this vulnerability extends beyond simple data exposure, as it represents a fundamental breakdown in the security model of Oracle Enterprise Manager's management infrastructure. Successful exploitation could enable attackers to access sensitive operational data including system configurations, monitoring information, and potentially other administrative details that would normally be restricted to authorized personnel only. This unauthorized read access capability directly violates the principle of least privilege and could provide adversaries with valuable intelligence for further attacks within the enterprise network environment.
Organizations must implement immediate mitigations including network segmentation to limit access to Oracle Enterprise Manager components, ensuring proper firewall rules restrict HTTPS access to trusted networks only, and applying available patches from Oracle as soon as they become available. The vulnerability's classification under CWE 287 (Improper Authentication) aligns with known attack patterns documented in MITRE ATT&CK framework under initial access techniques that leverage authentication bypass methods. Security teams should also conduct thorough network monitoring to detect potential exploitation attempts and consider implementing additional authentication layers or access controls beyond the default configuration to reduce the attack surface of this critical management platform component.