CVE-2026-46875: Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library)

Synopsis

A critical-severity vulnerability exists in the Deployment Library component of Oracle Enterprise Manager Base Platform, affecting versions 13.5 and 24.1. An authenticated attacker with administrative network access over HTTPS can exploit this flaw, and because the scope change flag is set in the CVSS vector, a successful attack reaches beyond the directly targeted component. Successful exploitation results in full takeover of the platform, giving the attacker complete control over confidentiality, integrity, and availability, including impact on additional dependent products. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Enterprise Manager Base Platform service over the network via HTTPS; the service must be accessible from the attacker's location.

• AuthenticationRequired

  A high-privileged (administrative) account is required; low-privilege credentials are not sufficient to trigger the vulnerability.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit the vulnerability entirely without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker gains full read access to all data managed by Oracle Enterprise Manager Base Platform, including monitored target credentials, configuration data, and stored secrets.
• The attacker can modify or destroy any persisted configuration, job definitions, or deployment artifacts within the platform.
• The attacker can crash or render the Enterprise Manager service fully unavailable, disrupting monitoring and management operations for all connected targets.
• Because the CVSS scope is changed, additional products managed or monitored by the platform are also at risk of compromise beyond the directly targeted component.