CVE-2026-46852: Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)

Synopsis

A critical remote code execution and full-takeover vulnerability exists in the Metadata Plugin component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. The flaw is reachable over HTTPS from any network location by an attacker holding any low-privilege account, with no further user interaction required; the CVSS scope-change indicator means a successful attack can break out of the affected component and compromise additional products in the environment. Successful exploitation gives an attacker full control over the platform, including read, write, and denial-of-service capabilities. No fix version has been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Enterprise Manager HTTPS endpoint over a network connection; no physical or local access is needed.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the platform; anonymous access is not sufficient, but no administrative rights are needed.

• Victim interactionNot required

  No action by any other user or administrator is needed to trigger the vulnerability; the attacker operates entirely on their own.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions such as race-timing or knowledge of memory layout.

Blast Radius

• A successful attacker reads all data managed by Oracle Enterprise Manager Base Platform, including credentials, monitored-target configurations, and stored monitoring metadata.
• The attacker can write to or delete any data on the platform, modifying monitoring configurations, targets, or stored credentials.
• The attacker can crash or fully disable the Oracle Enterprise Manager service, removing visibility and control over all managed infrastructure.
• Due to the CVSS scope change, the attacker can pivot from the Enterprise Manager component to compromise additional products and systems managed or reachable through the platform.