CVE-2026-46867: High severity Oracle Enterprise Manager Base Platform vulnerability
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Oracle Enterprise Manager Base Platform management interfaces (HTTPS). Enforce access only from a trusted management network or specific administrator IP addresses using firewall rules, VPN, or a jump host; block public Internet access to the console.
- Compensating control
Deploy network and application-layer protections to reduce exposure to remote exploitation: place the Enterprise Manager behind a WAF or reverse proxy with TLS termination/inspection and enable IDS/IPS signatures to detect and block exploit attempts over HTTPS.
- Operational
Continuously monitor logs and network traffic for indicators of compromise targeting Oracle Enterprise Manager. If compromise is suspected or confirmed, assume possible takeover and perform incident response: isolate affected systems, preserve forensic evidence, rebuild or restore from known-good backups, and rotate credentials for all high-privilege accounts.
- Operational
Track Oracle security advisories and apply vendor-supplied patches or mitigations to Oracle Enterprise Manager Base Platform as soon as they are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46867?
CVE-2026-46867 has a severity rating of high with a score of 7.2.
How do I fix CVE-2026-46867?
To fix CVE-2026-46867, upgrade to a patched version of Oracle Enterprise Manager Base Platform that addresses this vulnerability.
Which versions are affected by CVE-2026-46867?
CVE-2026-46867 affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1.
What is the risk involved with CVE-2026-46867?
CVE-2026-46867 poses a risk level of 66, indicating that it is easily exploitable by high privileged attackers with network access.
What component of Oracle is affected by CVE-2026-46867?
CVE-2026-46867 affects the Extensibility Framework component of the Oracle Enterprise Manager Base Platform.