CVE-2026-46857: Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service)

Synopsis

An unauthenticated remote code execution vulnerability affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1, specifically the Oracle Management Service component. The vulnerability is reachable over HTTP with no authentication required and no victim interaction needed, making it trivially exploitable from any network-accessible position. Successful exploitation results in full takeover of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Management Service over the network via HTTP; any internet- or intranet-exposed instance is in scope.

• AuthenticationNot required

  No credentials or session token of any kind are required; the attack is available to any unauthenticated party with network access.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is fully server-side and requires no human action on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites.

Blast Radius

• A successful attacker gains full control over the Oracle Enterprise Manager Base Platform instance, including the ability to read all managed-target credentials, monitoring data, and configuration stored within the platform.
• The attacker can modify or delete monitoring policies, agent configurations, and job definitions across every managed target registered with the compromised Enterprise Manager installation.
• The attacker can crash or render unavailable the Oracle Management Service and all dependent monitoring and automation workflows, causing a complete loss of observability for managed infrastructure.
• Because Enterprise Manager holds credentials for downstream managed databases and hosts, a compromise provides a pivot point to laterally access those systems.