CVE-2026-46854: Oracle Enterprise Manager Escalation Flaw

CVE-2026-46854 Overview

CVE-2026-46854 is a critical vulnerability in the Oracle Enterprise Manager Base Platform within the Target Management component. The flaw affects Oracle Enterprise Manager versions 13.5 and 24.1. A low-privileged attacker with network access via HTTP can exploit this weakness to compromise the platform. The issue is classified under improper access control [CWE-284].

Successful exploitation leads to full takeover of Oracle Enterprise Manager Base Platform. The vulnerability carries a scope change, meaning attacks can significantly impact additional Oracle products beyond the vulnerable component itself.

Critical Impact
Authenticated attackers can take over Oracle Enterprise Manager Base Platform over the network with low privileges, with cascading impact on connected Oracle products managed by the platform.

Affected Products

Oracle Enterprise Manager Base Platform version 13.5.0.0
Oracle Enterprise Manager Base Platform version 24.1.0.0.0
Target Management component within Oracle Enterprise Manager

Discovery Timeline

2026-06-17 - CVE-2026-46854 published to NVD
2026-06-18 - Last updated in NVD database
2026-06-17 - Oracle published security alert covering this vulnerability

Technical Details for CVE-2026-46854

Vulnerability Analysis

The vulnerability resides in the Target Management component of Oracle Enterprise Manager Base Platform. Target Management handles registration, monitoring, and lifecycle operations for managed targets such as databases, middleware, and host systems. A flaw in access control [CWE-284] allows a low-privileged user with HTTP access to perform actions beyond their permitted scope.

Because Enterprise Manager orchestrates downstream Oracle products, the scope-change condition means an attacker who compromises the platform can pivot to managed targets. The exploitation does not require user interaction and carries no special prerequisites beyond a low-privileged account and network reachability to the Enterprise Manager HTTP service.

The combination of high confidentiality, integrity, and availability impact reflects full platform takeover. Attackers gain the ability to read sensitive configuration data, modify monitoring policies, and disrupt operations across the managed estate.

Root Cause

The root cause is improper access control within the Target Management component. The component fails to adequately validate authorization for HTTP-accessible operations, permitting privileged actions to be invoked by accounts that should not possess them. Oracle has not published technical specifics in the public advisory.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates with a low-privileged Enterprise Manager account, then issues crafted HTTP requests to Target Management endpoints. Because the scope changes, the impact extends to additional Oracle products under management. Public proof-of-concept code is not currently available.

No verified exploit code is publicly available. Refer to the Oracle Security Alert for technical guidance.

Detection Methods for CVE-2026-46854

Indicators of Compromise

Unexpected HTTP requests to Oracle Enterprise Manager Target Management endpoints originating from low-privileged user sessions.
New or modified target registrations, monitoring templates, or agent associations created outside change windows.
Authentication events from EM accounts performing administrative actions inconsistent with their assigned roles.
Outbound activity from the Enterprise Manager host to managed targets that does not align with scheduled jobs.

Detection Strategies

Audit Oracle Enterprise Manager access logs for HTTP requests that exercise privileged Target Management operations from non-administrative accounts.
Correlate Enterprise Manager audit records with identity provider logs to identify authorization anomalies and role drift.
Baseline normal Target Management API call patterns and alert on deviations such as bulk target enumeration or configuration changes.

Monitoring Recommendations

Enable verbose auditing on the Oracle Management Service (OMS) and forward logs to a centralized SIEM for retention and analysis.
Monitor the EM repository database for unexpected modifications to MGMT_* tables associated with target metadata and credentials.
Track privileged credential checkout events from Enterprise Manager's Named Credentials store.

How to Mitigate CVE-2026-46854

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the June 2026 advisory to all Oracle Enterprise Manager 13.5 and 24.1 deployments.
Restrict network access to the Enterprise Manager HTTP and HTTPS console ports to administrative networks only.
Review all Enterprise Manager user accounts and revoke unnecessary low-privileged access pending patch deployment.
Rotate Named Credentials and privileged passwords stored within Enterprise Manager after patching.

Patch Information

Oracle released a fix as part of the June 2026 Critical Security Patch Update. Patch details and download links are available in the Oracle Security Alert. Administrators should follow Oracle's documented OMSPatcher procedure to apply the update to the Oracle Management Service and any management agents identified in the advisory.

Workarounds

Place the Enterprise Manager console behind a reverse proxy or VPN that enforces strong authentication and IP allow-listing.
Disable or lock unused Enterprise Manager accounts and enforce least privilege on remaining roles until patches are applied.
Increase audit log retention and review frequency for the Target Management component while remediation is in progress.

bash

# Verify Enterprise Manager patch level after applying the June 2026 CPU
$ORACLE_HOME/OMSPatcher/omspatcher lspatches

# Restrict console access at the OS firewall (example for Oracle Linux)
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port port="7803" protocol="tcp" accept'
firewall-cmd --permanent --remove-port=7803/tcp
firewall-cmd --reload