CVE-2026-46865: High severity Oracle Enterprise Manager Base Platform vulnerability
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict interactive and administrative logon to the infrastructure where Oracle Enterprise Manager Base Platform executes. Implement network ACLs/firewall rules, require use of jump hosts or bastion hosts, and limit logon to trusted administrator accounts so that untrusted users cannot obtain the required logon to exploit this issue.
- Compensating control
Segment and isolate hosts running Oracle Enterprise Manager Base Platform from other products and from untrusted networks to reduce scope and prevent lateral movement in case of exploitation.
- Operational
If compromise is suspected (or after applying mitigations), perform incident response: investigate affected systems, rebuild or restore impacted hosts from known-good backups, and rotate any credentials, service accounts, and keys used by Oracle Enterprise Manager and related services.
- Operational
Increase monitoring and log review on hosts running Oracle Enterprise Manager Base Platform to detect signs of exploitation and suspicious high-privilege activity; retain forensic logs while investigating.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46865?
CVE-2026-46865 has a severity rating of 8.2, categorized as high.
How do I fix CVE-2026-46865?
To mitigate CVE-2026-46865, ensure your Oracle Enterprise Manager Base Platform is updated to a non-vulnerable version.
Who is affected by CVE-2026-46865?
CVE-2026-46865 affects users of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1.
What impact does CVE-2026-46865 have?
CVE-2026-46865 allows a high privileged attacker to exploit the system if they have logon access.
Can CVE-2026-46865 be exploited remotely?
CVE-2026-46865 is classified as easily exploitable, requiring the attacker to have logon access to the infrastructure.