CVE-2026-46855: Oracle Enterprise Manager Privilege Escalation

CVE-2026-46855 Overview

CVE-2026-46855 is a critical vulnerability in the Oracle Enterprise Manager Base Platform, specifically within the Metadata Plugin component. The flaw affects supported versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can exploit this issue to fully compromise Oracle Enterprise Manager Base Platform. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond the vulnerable component. Oracle published this issue in its June 2026 Critical Security Patch Update advisory. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
Successful exploitation results in complete takeover of Oracle Enterprise Manager Base Platform with high impact to confidentiality, integrity, and availability across linked products.

Affected Products

Oracle Enterprise Manager Base Platform 13.5.0.0
Oracle Enterprise Manager Base Platform 24.1.0.0.0
Oracle Enterprise Manager (Metadata Plugin component)

Discovery Timeline

2026-06-17 - CVE-2026-46855 published to NVD as part of Oracle's June 2026 Critical Security Patch Update
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46855

Vulnerability Analysis

The vulnerability resides in the Metadata Plugin component of Oracle Enterprise Manager Base Platform. An authenticated attacker holding only low-level privileges can reach the vulnerable code path over the network via HTTPS. The attack complexity is low and no user interaction is required, making exploitation straightforward once network access and minimal credentials are obtained.

The scope change is the most consequential aspect of this issue. A compromise of the Metadata Plugin does not remain isolated to Enterprise Manager. Because Enterprise Manager manages and orchestrates a wide range of Oracle products, including database instances, middleware, and infrastructure, an attacker can pivot into those managed targets. The vulnerability impacts confidentiality, integrity, and availability at the highest level.

Root Cause

The issue is mapped to [CWE-284: Improper Access Control]. Oracle's advisory does not publicly disclose internal implementation details, but the classification indicates the Metadata Plugin fails to properly enforce authorization checks on specific operations. This permits a low-privileged user to perform actions reserved for higher-privileged accounts or to manipulate metadata that influences downstream managed systems.

Attack Vector

The attack vector is network-based over HTTPS to the Enterprise Manager management console or its API endpoints. The attacker authenticates with any low-privileged account on the platform, then issues requests against the Metadata Plugin to escalate privileges or alter managed resources. No user interaction is required from administrators. Because Enterprise Manager typically stores credentials and connection information for managed databases and middleware, takeover provides immediate lateral movement opportunities.

No public proof-of-concept exploit is available at this time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.441% (percentile 35.061) as of 2026-06-18.

Detection Methods for CVE-2026-46855

Indicators of Compromise

Unexpected administrative actions or metadata changes performed by low-privileged Enterprise Manager accounts.
HTTPS requests to Metadata Plugin endpoints from unusual source addresses or at atypical times.
New or modified named credentials, preferred credentials, or targets in Enterprise Manager not tied to a change ticket.
Authentication anomalies followed by job submissions or agent command executions against managed targets.

Detection Strategies

Audit Enterprise Manager EM_ACCESS_LOG and emoms.log entries for low-privileged accounts invoking metadata or plugin-related URIs.
Correlate Enterprise Manager activity with downstream database and middleware logs to identify scope-changing actions originating from the management platform.
Baseline normal API call patterns for each Enterprise Manager role and alert on deviations, particularly POST or PUT requests to Metadata Plugin paths.

Monitoring Recommendations

Forward Enterprise Manager OMS and repository audit logs to a centralized SIEM with retention sufficient for incident reconstruction.
Monitor outbound connections from Oracle Management Service hosts to managed targets for unexpected job execution or remote command activity.
Enable and review the Enterprise Manager Audit Framework for SUPER_USER, CREATE_TARGET, and credential modification events.

How to Mitigate CVE-2026-46855

Immediate Actions Required

Apply the Oracle June 2026 Critical Security Patch Update to all Enterprise Manager Base Platform deployments running versions 13.5 and 24.1.
Inventory all Enterprise Manager instances, including non-production and disaster recovery environments, and prioritize internet-reachable or weakly segmented systems.
Rotate named credentials, preferred credentials, and any service account passwords stored in Enterprise Manager following patch application.
Review user accounts and remove or reduce low-privileged accounts that are not strictly required.

Patch Information

Oracle addressed CVE-2026-46855 in the June 2026 Critical Patch Update. Administrators should download and apply the relevant patches for Enterprise Manager Base Platform 13.5 and 24.1 referenced in the Oracle Security Alert. Patching must include both the Oracle Management Service tier and the affected plugin components on management agents where applicable.

Workarounds

Restrict network access to the Enterprise Manager console and APIs to a hardened management network or jump-host segment.
Enforce multi-factor authentication for all Enterprise Manager accounts, including low-privileged users, to raise the bar for credential abuse.
Disable or quarantine accounts that do not require active access until patching is complete.

bash

# Example: restrict access to the Oracle Management Service HTTPS port
# using host-based firewall rules (Linux iptables)
iptables -A INPUT -p tcp --dport 7803 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7803 -j DROP

# Review Enterprise Manager users with low privileges
# from the repository database (run as SYSMAN)
SELECT user_name, user_type, created
  FROM mgmt_created_users
 WHERE user_type = 'EM_USER';