CVE-2026-46868: Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework)

Synopsis

This is a high-severity vulnerability in the Extensibility Framework component of Oracle Enterprise Manager Base Platform, affecting versions 13.5 and 24.1. The vulnerability is reachable over the network via HTTPS and requires a high-privileged (administrative) account to exploit, with no victim interaction needed. Successful exploitation gives an attacker full control over the affected platform, including access to all data, the ability to modify configuration, and the ability to disrupt service availability. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Enterprise Manager instance over the network via HTTPS; internet or internal network exposure to the management interface is sufficient.

• AuthenticationRequired

  A high-privileged (administrative) account is required; the attacker must possess or compromise admin credentials before exploitation is possible.

• Victim interactionNot required

  No action from any other user or administrator is needed to complete the attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• An attacker gains full read access to all data managed by the Enterprise Manager platform, including monitored target credentials, configuration data, and stored monitoring metadata.
• An attacker can modify Enterprise Manager configuration, job definitions, and target management policies, allowing persistent changes to monitored infrastructure.
• An attacker can crash or fully disable the Enterprise Manager service, eliminating visibility into the monitored infrastructure.
• Full platform takeover is possible, meaning the attacker can use the compromised Enterprise Manager instance as a pivot point to interact with all registered managed targets.