CVE-2026-46872: Critical severity Oracle Enterprise Manager Base Platform vulnerability
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Install). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle Enterprise Manager Base Platform management interface (HTTPS). Implement firewall/ACL rules to allow only trusted administrator IPs, place the management interface on a management-only network segment or VPN, and consider a WAF to block malicious requests. Block or limit public/Internet access to affected instances until a vendor fix is applied.
- Operational
Identify and inventory all Oracle Enterprise Manager Base Platform instances and determine if they are version 13.5 or 24.1 (both are reported affected). Prioritize isolating, disabling, or taking affected instances offline where feasible. Monitor logs and network traffic for indicators of compromise and prepare incident response. Contact Oracle Support for vendor guidance and apply any vendor-supplied patches or mitigations immediately when released; retain backups and snapshots to support recovery.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46872?
CVE-2026-46872 has a critical severity rating of 9.
How do I fix CVE-2026-46872?
To fix CVE-2026-46872, upgrade to the latest supported version of Oracle Enterprise Manager Base Platform.
What components are affected by CVE-2026-46872?
CVE-2026-46872 affects the Install component of Oracle Enterprise Manager Base Platform.
What versions are impacted by CVE-2026-46872?
The affected versions of Oracle Enterprise Manager are 13.5 and 24.1.
What type of access is required to exploit CVE-2026-46872?
A high privileged attacker with network access via HTTPS is required to exploit CVE-2026-46872.