CVE-2026-46857: Oracle Enterprise Manager Auth Bypass Flaw

CVE-2026-46857 Overview

CVE-2026-46857 is a critical vulnerability in the Oracle Enterprise Manager Base Platform, specifically affecting the Oracle Management Service component. The flaw allows an unauthenticated remote attacker to compromise the platform over HTTP without user interaction. Successful exploitation can result in full takeover of the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability. Affected versions include 13.5 and 24.1. Oracle published the fix through its Critical Patch Update Security Alert in June 2026. The weakness is classified under [CWE-284] Improper Access Control.

Critical Impact
An unauthenticated network attacker can take over Oracle Enterprise Manager Base Platform via HTTP, gaining control over managed Oracle infrastructure.

Affected Products

Oracle Enterprise Manager Base Platform 13.5.0.0
Oracle Enterprise Manager Base Platform 24.1.0.0.0
Oracle Management Service component

Discovery Timeline

2026-06-17 - CVE-2026-46857 published to the National Vulnerability Database (NVD)
2026-06-18 - Last updated in NVD database
June 2026 - Oracle releases security patch via Critical Patch Update Security Alert

Technical Details for CVE-2026-46857

Vulnerability Analysis

CVE-2026-46857 affects the Oracle Management Service (OMS), the central control tier of Oracle Enterprise Manager (OEM). OMS coordinates monitoring agents, processes telemetry, and exposes administrative HTTP endpoints used by operators. A flaw in this component allows an attacker with only network reachability to take control of the platform. No credentials and no user interaction are required. Because OEM Base Platform manages databases, middleware, and engineered systems, compromise of OMS typically cascades into the broader Oracle estate. The vulnerability maps to [CWE-284] Improper Access Control, indicating an authorization or trust boundary failure within an HTTP-accessible interface.

Root Cause

Oracle's advisory categorizes the issue under improper access control in the Oracle Management Service component. The HTTP-facing interface fails to correctly enforce authentication or authorization checks before processing privileged operations. As a result, requests that should require an authenticated administrator can be processed without credentials.

Attack Vector

The attack vector is network-based over HTTP, with low attack complexity and no privileges required. An attacker sends crafted HTTP requests to an exposed OMS endpoint and triggers privileged functionality. The EPSS score is 0.508% (percentile 39.241) as of 2026-06-18, which reflects current public exploitation likelihood rather than the technical ease of exploitation.

No verified public proof-of-concept code is available at this time. Refer to the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-46857

Indicators of Compromise

Unexpected HTTP requests to Oracle Management Service endpoints from external or non-administrative source IP addresses.
New administrative accounts, agent registrations, or job submissions in OEM without a matching change record.
Outbound connections from OMS hosts to untrusted destinations following inbound HTTP traffic spikes.
Modifications to OEM repository tables, credentials, or monitoring templates outside scheduled maintenance windows.

Detection Strategies

Inspect web access logs on the OMS tier for anomalous URIs, repeated 4xx/5xx sequences, or requests bypassing the standard login flow.
Correlate OMS process activity with unexpected child processes spawned by the WebLogic or OHS service accounts.
Hunt for OEM administrative actions (job creation, credential reads, target additions) that lack a corresponding authenticated session ID.

Monitoring Recommendations

Forward OMS access logs, WebLogic audit logs, and OEM repository audit data to a centralized SIEM for correlation.
Alert on first-seen source IPs reaching OMS HTTP/HTTPS listeners, especially from outside management subnets.
Baseline normal OEM job and credential usage, then alert on deviations such as off-hours bulk credential access.

How to Mitigate CVE-2026-46857

Immediate Actions Required

Apply the Oracle June 2026 Critical Patch Update Security Alert to OEM Base Platform 13.5 and 24.1 without delay.
Restrict network access to the Oracle Management Service so that only authorized administrative networks can reach its HTTP/HTTPS endpoints.
Review OMS and repository audit logs for signs of unauthenticated administrative actions prior to patching.
Rotate OEM Named Credentials, agent registration passwords, and any secrets stored in the OEM repository after remediation.

Patch Information

Oracle addresses CVE-2026-46857 in the June 2026 Critical Patch Update Security Alert. Administrators should review the Oracle Security Alert for the specific patch identifiers, prerequisites, and applicability to OEM 13.5.0.0 and 24.1.0.0.0 deployments. Patching must be applied to the OMS tier and any associated middleware components called out by Oracle.

Workarounds

Place OMS behind a reverse proxy or web application firewall configured to allow only authenticated administrative paths from known source ranges.
Use network segmentation, host firewalls, and VPN-only access to remove OMS HTTP listeners from general corporate or internet reachability.
Disable or block any non-essential OMS HTTP endpoints until the official patch can be deployed.

bash

# Example: restrict OMS HTTP/HTTPS access to a management subnet using iptables
# Replace 10.10.20.0/24 with your authorized administrative network
iptables -A INPUT -p tcp --dport 7799 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7799 -j DROP
iptables -A INPUT -p tcp --dport 7802 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7802 -j DROP