CVE-2026-46866: Oracle Enterprise Manager Base Platform DOS

CVE-2026-46866 Overview

CVE-2026-46866 is a high-severity vulnerability in the Oracle Enterprise Manager Base Platform, specifically within the Agent Next Gen component. The flaw affects supported versions 13.5 and 24.1. An unauthenticated remote attacker can exploit this vulnerability over HTTPS with low attack complexity. Successful exploitation results in a complete denial of service through hangs or repeatable crashes. The vulnerability also permits unauthorized update, insert, or delete operations against a subset of accessible data. Oracle published the fix in the Critical Patch Update Advisory for June 2026.

Critical Impact
Unauthenticated network attackers can crash Oracle Enterprise Manager Base Platform and tamper with a subset of accessible data, disrupting enterprise monitoring infrastructure.

Affected Products

Oracle Enterprise Manager Base Platform version 13.5.0.0
Oracle Enterprise Manager Base Platform version 24.1.0.0.0
Agent Next Gen component within Oracle Enterprise Manager

Discovery Timeline

2026-06-17 - CVE-2026-46866 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases security patch via Oracle Security Alert June 2026

Technical Details for CVE-2026-46866

Vulnerability Analysis

The vulnerability resides in the Agent Next Gen component of Oracle Enterprise Manager Base Platform. It is classified under [CWE-400] Uncontrolled Resource Consumption. An attacker sends crafted HTTPS requests to the Agent Next Gen endpoint without requiring credentials or user interaction. The crafted input triggers resource exhaustion conditions in the agent communication handler.

The outcome is a complete denial of service. The Enterprise Manager instance hangs or crashes repeatedly until the underlying issue is addressed. Beyond availability impact, the vulnerability allows partial integrity compromise. An attacker can perform unauthorized writes against some accessible data without reading the contents.

Enterprise Manager is a central monitoring and administration plane for Oracle estates. Disruption of this platform blinds operators to database health, alerts, and lifecycle operations across managed targets.

Root Cause

The Agent Next Gen component fails to enforce proper resource limits on inbound network requests. The handler accepts unauthenticated input and processes it without bounding consumption or validating request structure. This permits an attacker to drive the service into an unrecoverable state.

Attack Vector

Exploitation occurs entirely over the network using HTTPS against the exposed Agent Next Gen interface. No authentication or user interaction is required. The attacker requires only network reachability to the management platform. See the Oracle Security Alert June 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-46866

Indicators of Compromise

Unexpected hangs, restarts, or crash loops of the oms (Oracle Management Service) or Agent Next Gen processes
Spikes in inbound HTTPS connections to Enterprise Manager Agent ports from unrecognized sources
Unexplained modifications, inserts, or deletions in Enterprise Manager repository tables
Gaps in monitoring telemetry from managed targets coinciding with malformed request bursts

Detection Strategies

Monitor Enterprise Manager logs under $ORACLE_HOME/gc_inst/em/EMGC_OMS1/sysman/log/ for repeated agent communication failures or thread pool exhaustion
Inspect HTTPS request patterns to the Agent Next Gen listener for anomalous request rates or oversized payloads
Correlate database audit logs against Enterprise Manager repository write activity to detect unauthorized data changes

Monitoring Recommendations

Establish baseline metrics for Agent Next Gen request volume and alert on deviations
Enable verbose logging on the OMS during the remediation window to capture exploitation attempts
Forward Enterprise Manager logs and HTTPS proxy telemetry to a centralized SIEM for correlation and historical analysis

How to Mitigate CVE-2026-46866

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert June 2026 to versions 13.5 and 24.1
Restrict network access to Enterprise Manager Agent Next Gen endpoints to trusted management subnets only
Audit Enterprise Manager repository tables for unauthorized inserts, updates, or deletes since deployment
Verify backup and recovery procedures for the Enterprise Manager repository before patching

Patch Information

Oracle addresses CVE-2026-46866 in the June 2026 Critical Patch Update. Administrators should download and apply the Enterprise Manager patches corresponding to their installed version (13.5 or 24.1) following Oracle's documented OPatch procedures. Validate patch application by confirming version metadata via emctl status oms -details after deployment.

Workarounds

Place the Agent Next Gen listener behind a network firewall or reverse proxy that enforces strict source IP allowlists
Apply rate limiting on HTTPS traffic destined for the Enterprise Manager management ports
Disable or isolate the Agent Next Gen component in environments where it is not actively required until patching completes

bash

# Example: restrict Agent Next Gen port access with iptables
iptables -A INPUT -p tcp --dport 3872 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3872 -j DROP

# Verify OMS version after patching
emctl status oms -details