CVE-2026-46856: Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)

Synopsis

A critical cross-scope vulnerability exists in the Metadata Plugin component of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1). The flaw is reachable over HTTP from the network without any authentication, but requires a victim to perform some interaction, such as clicking a crafted link or visiting a malicious page. Successful exploitation results in full takeover of Oracle Enterprise Manager Base Platform, with high impact to confidentiality, integrity, and availability, and the scope change indicator means the compromise can spill into adjacent systems beyond the directly affected product. No fix versions have been published yet; HarborGuard is tracking the advisory and will make a patched rebuild available as soon as Oracle ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Enterprise Manager Base Platform service over the network via HTTP; no local or physical access is required.

• AuthenticationNot required

  No credentials or account of any privilege level are needed; the attack path is fully unauthenticated.

• Victim interactionRequired

  A person other than the attacker must take an action, such as clicking a crafted link or loading a malicious page, for the exploit to succeed.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads all data accessible to Oracle Enterprise Manager Base Platform, including managed target credentials, monitoring configuration, and stored session material.
• The attacker can modify or delete persisted configuration data, managed-target definitions, and monitoring policies within the platform.
• The attacker can crash or otherwise render the Enterprise Manager service unavailable, disrupting monitoring and management of all connected targets.
• Because the CVSS scope is changed, compromise can extend beyond Oracle Enterprise Manager itself into other products and systems that the platform manages or communicates with.