CVE-2026-46867: Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework)

Synopsis

This is a high-severity vulnerability in the Extensibility Framework component of Oracle Enterprise Manager Base Platform, affecting versions 13.5 and 24.1. The flaw is reachable over the network via HTTPS and requires an authenticated attacker with administrative privileges to exploit. Successful exploitation gives the attacker full control of the Oracle Enterprise Manager Base Platform instance, with complete impact to confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will surface a patched-image rebuild as soon as upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Enterprise Manager HTTPS endpoint over the network; there is no local-only attack path.

• AuthenticationRequired

  An administrative (high-privilege) account is required; an unprivileged or anonymous attacker cannot exploit this vulnerability directly.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit the vulnerability entirely on their own without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or any other variable environmental factor.

Blast Radius

• A successful attacker reads all data accessible to the Enterprise Manager platform, including monitored target credentials, configuration data, and stored monitoring policies.
• The attacker can modify or delete persisted configuration, targets, jobs, and compliance rules managed by the Enterprise Manager instance.
• The attacker can crash or otherwise take down the Enterprise Manager service, disrupting monitoring and management visibility across all connected targets.
• Full platform takeover means the attacker can pivot through Enterprise Manager agent connectivity to interact with every managed host and database registered to the instance.