CVE-2026-46866: High severity Oracle Enterprise Manager Base Platform vulnerability
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Manager Base Platform as well as unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If HTTPS access to the Agent Next Gen component is not required, disable the HTTPS listener; otherwise restrict it to the internal/management network or a limited set of management hosts.
Oracle Enterprise Manager Base Platform (Agent Next Gen) HTTPS listener/access = disabled or restricted to management network - Compensating control
Restrict network access to the Oracle Enterprise Manager Base Platform (Agent Next Gen) HTTPS interface to trusted IPs only. Use firewall rules, ACLs, VPN/bastion host, or network segmentation to block unauthenticated access from untrusted networks.
- Compensating control
Place the Oracle Enterprise Manager HTTPS endpoint behind a reverse proxy or web application firewall (WAF) to filter and rate-limit requests, and to provide an additional layer of inspection for malicious HTTPS traffic that could exploit the vulnerability.
- Operational
Monitor affected systems for hangs, crashes (DoS) and for unauthorized update/insert/delete activity. If anomalous behavior is detected, isolate the host(s), collect forensic logs, restore services from known-good backups if needed, and investigate any data integrity impacts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46866?
The severity of CVE-2026-46866 is rated as high with a score of 8.2.
How does CVE-2026-46866 impact Oracle Enterprise Manager?
CVE-2026-46866 allows an unauthenticated attacker to compromise Oracle Enterprise Manager components via network access.
What versions of Oracle Enterprise Manager are affected by CVE-2026-46866?
The affected versions of Oracle Enterprise Manager are 13.5 and 24.1.
Can CVE-2026-46866 be exploited remotely?
Yes, CVE-2026-46866 can be easily exploited by an unauthenticated attacker with network access via HTTPS.
How do I fix CVE-2026-46866?
To fix CVE-2026-46866, ensure to apply the latest patches and updates provided by Oracle for affected versions.