CVE-2026-46993 in Enterprise Manager Base Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Manager Base Platform's Agent Next Gen component, representing a significant security weakness that affects versions 13.5 and 24.1. The flaw manifests as a difficult-to-exploit issue that requires minimal privileges but can be leveraged by network-based attackers through HTTPS connections. The vulnerability's classification as low privilege access with network exposure creates a dangerous attack surface where adversaries can potentially compromise the entire Oracle Enterprise Manager ecosystem. This represents a critical concern for enterprise environments that rely on Oracle's monitoring and management platforms for infrastructure oversight.
The technical nature of this vulnerability allows for unauthorized modification, deletion, and creation operations against critical data within the Oracle Enterprise Manager Base Platform scope. Attackers who successfully exploit this weakness can gain complete access to all data accessible through the platform, including sensitive configuration information, monitoring data, and potentially system credentials. The CVSS 3.1 score of 8.2 reflects the high impact potential with confidentiality and integrity impacts rated as high severity, while availability remains unchanged at neutral. This vulnerability demonstrates characteristics consistent with CWE-287 (Improper Authentication) and CWE-502 (Deserialization of Untrusted Data) patterns commonly found in enterprise management platforms.
The operational impact extends beyond the immediate Oracle Enterprise Manager Base Platform to encompass additional products within the broader Oracle ecosystem, indicating a scope change that amplifies the potential damage. This cascading effect aligns with ATT&CK tactics such as T1078 (Valid Accounts) and T1566 (Phishing) where initial access can lead to broader system compromise. Organizations utilizing these platforms face significant risks including data exfiltration, system integrity compromise, and potential disruption of critical infrastructure monitoring capabilities. The vulnerability's network-based exploitation vector means that attackers don't require physical access or elevated privileges within the target environment.
Mitigation strategies should prioritize immediate patch management for affected versions 13.5 and 24.1, implementing network segmentation to limit exposure of Oracle Enterprise Manager components, and establishing robust monitoring protocols for unusual authentication patterns or data access attempts. Organizations should also consider implementing additional authentication controls such as multi-factor authentication and privileged access management solutions. The vulnerability's characteristics suggest that traditional network firewalls may not provide adequate protection, requiring more sophisticated security measures including application-level controls and continuous monitoring of agent communications. Regular security assessments of Oracle Enterprise Manager implementations are essential to identify potential exploitation vectors and maintain defensive posture against evolving threats targeting enterprise management platforms.