CVE-2026-46866: Oracle Enterprise Manager RCE & DoS Vulnerability – High-Risk Patch Required

Technical summary

CVE-2026-46866 is a network-accessible vulnerability in the Agent Next Gen component of Oracle Enterprise Manager Base Platform. The vulnerability is rooted in improper resource handling (CWE-400), which allows unauthenticated attackers to submit requests that exhaust system resources, leading to hang or crash conditions, or to bypass integrity controls and modify accessible data stores. The attack vector is HTTPS (network-based), requires no authentication, no user interaction, and no special access privileges. The vulnerability affects the base platform itself rather than requiring prior compromise of managed systems. CVSS 3.1 score of 8.2 reflects high availability impact (complete DoS potential) combined with low integrity impact (unauthorized data modification).

Business impact

Successful exploitation of this vulnerability can result in extended downtime of Oracle Enterprise Manager—the centralized management and monitoring platform for enterprise infrastructure. Since Enterprise Manager serves as the operational hub for visibility and control across managed systems, its unavailability degrades an organization's ability to monitor, manage, and respond to issues across its IT estate. Additionally, unauthorized data modification could corrupt monitoring configurations, alert thresholds, or metadata, leading to incorrect operational decisions or loss of audit trails. The ease of exploitation and lack of authentication requirement significantly increases risk exposure.

Affected systems

Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are confirmed affected. Organizations running these specific versions with network-accessible Enterprise Manager installations face direct risk. The vulnerability does not affect managed agents or target systems directly; rather, it compromises the central platform itself. Customers on other Enterprise Manager versions should verify compatibility against the official vendor advisory to confirm their status.

Exploitability

This vulnerability is easily exploitable with a CVSS exploitability score reflecting no authentication requirement, low attack complexity, and network accessibility. An attacker needs only network reachability to the Enterprise Manager platform via HTTPS—a typical configuration in managed environments. The lack of authentication and user interaction requirements means attackers can launch attacks at scale without credential theft or social engineering. Repeatability (consistent crash or data modification) further simplifies weaponization. However, the vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Organizations must apply vendor security patches to Enterprise Manager Base Platform 13.5 and 24.1 immediately. Patch details and version numbers are available in the official Oracle Critical Patch Update advisory. Pending patch deployment, mitigate risk by restricting network access to the Enterprise Manager platform to trusted management networks, disabling unnecessary HTTPS endpoints, and monitoring for suspicious requests. Consider implementing network segmentation or VPN requirements for Enterprise Manager access.

Patch guidance

Consult the Oracle Critical Patch Update advisory issued June 2026 for exact patch versions for Enterprise Manager Base Platform 13.5 and 24.1. Apply patches in a controlled sequence, testing in non-production environments first to ensure compatibility with custom configurations or integrations. Patch deployment should be prioritized for production Enterprise Manager instances. Verify successful remediation by confirming the patched version and testing basic platform operations (authentication, data retrieval, agent communication) post-patch.

Detection guidance

Monitor Enterprise Manager logs for repeated HTTPS connection attempts from unauthenticated sources, unusual request patterns, or resource exhaustion events preceding platform hangs or crashes. Track system resource metrics (CPU, memory, file handles) for anomalies during non-peak hours. Implement alerting for data modification events in Enterprise Manager repositories, especially unauthorized insert/update/delete operations. Use network intrusion detection signatures targeting CWE-400 (uncontrolled resource consumption) patterns directed at Enterprise Manager endpoints. Log analysis should correlate HTTPS errors with platform availability incidents.

Why prioritize this

This vulnerability merits immediate remediation because it requires no authentication or user interaction, is easily exploitable over the network, and directly impacts critical infrastructure monitoring capability. The combination of high availability impact (DoS) and integrity compromise affects operational resilience. Enterprise Manager is often a high-value target because it provides attackers visibility and control over the broader infrastructure once compromised. The existence of versions 13.5 and 24.1 suggests a wide installed base spanning legacy and current deployments.

Risk score, explained

CVSS 3.1 score of 8.2 (HIGH) reflects: (1) Network attack vector—remote exploitation without special tools; (2) Low attack complexity—straightforward request crafting; (3) No authentication or user interaction—immediate attack surface; (4) High availability impact—complete denial of service possible; (5) Low integrity impact—unauthorized data modification within accessible scope; (6) No confidentiality impact—no information disclosure. The score emphasizes availability and integrity compromise over confidentiality, appropriate for an infrastructure management platform where operational continuity is paramount.

Frequently asked questions