CVE-2026-46872: Oracle Enterprise Manager Auth Bypass Flaw

CVE-2026-46872 Overview

CVE-2026-46872 is a vulnerability in the Install component of Oracle Enterprise Manager Base Platform. The flaw affects supported versions 13.5 and 24.1. An authenticated attacker with high privileges and network access via HTTPS can compromise the platform. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the vulnerable component itself. Oracle classifies the issue under improper access control [CWE-284].

Critical Impact
Successful exploitation enables unauthorized creation, deletion, or modification of critical data, partial read access to platform data, and complete denial of service of Oracle Enterprise Manager Base Platform.

Affected Products

Oracle Enterprise Manager Base Platform 13.5.0.0
Oracle Enterprise Manager Base Platform 24.1.0.0.0
Oracle Enterprise Manager (Install component)

Discovery Timeline

2026-06-17 - CVE CVE-2026-46872 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle published security alert cspujun2026

Technical Details for CVE-2026-46872

Vulnerability Analysis

The vulnerability resides in the Install component of Oracle Enterprise Manager Base Platform. It allows a high-privileged authenticated attacker to abuse functionality reachable over HTTPS. The scope change indicates that exploitation crosses a security boundary, allowing attackers to affect components managed by the platform beyond the vulnerable module itself.

Because Enterprise Manager centrally administers databases, middleware, and infrastructure, abuse of the Install pathway can cascade into administered targets. The result is unauthorized write access to critical data, partial unauthorized reads, and the ability to crash or hang the platform completely. Oracle maps the weakness to improper access control [CWE-284], indicating that authorization checks within the Install workflow are insufficient for the privileges they expose.

Root Cause

The root cause is improper access control [CWE-284] within the Install component. Privileged HTTPS-reachable functionality enforces insufficient authorization, allowing a high-privileged actor to perform operations that should be restricted or that should not cross into the scope of administered components.

Attack Vector

Exploitation requires network reachability to the Enterprise Manager HTTPS interface and an authenticated session with high privileges. The attack complexity is low and no user interaction is required. Once exploited, the attacker can modify or destroy data, read a subset of accessible data, and induce a complete denial of service.

No public proof-of-concept code is available for CVE-2026-46872. Refer to the Oracle Critical Patch Update Advisory - June 2026 for vendor technical details.

Detection Methods for CVE-2026-46872

Indicators of Compromise

Unexpected administrative actions performed by Enterprise Manager privileged accounts against the Install component over HTTPS.
Unscheduled creation, modification, or deletion of repository objects or managed-target configurations.
Sudden hangs or repeated crashes of the Oracle Management Service (OMS) without correlated maintenance activity.
Outbound or lateral activity from the Enterprise Manager host that deviates from baseline administrative workflows.

Detection Strategies

Audit Enterprise Manager privileged-account usage and flag administrative sessions originating from atypical source addresses or outside change windows.
Correlate OMS log entries for Install component activity with repository database audit events to identify scope-crossing operations.
Monitor HTTPS request patterns to the Enterprise Manager console for anomalous Install endpoint invocations.

Monitoring Recommendations

Enable detailed auditing on the OMS repository for DDL and privileged DML events.
Forward Oracle Enterprise Manager and host logs to a centralized analytics platform for correlation and retention.
Alert on service restarts, repeated crashes, or availability dips on the OMS tier.

How to Mitigate CVE-2026-46872

Immediate Actions Required

Apply the patches from the Oracle Critical Patch Update published June 2026 to all 13.5 and 24.1 Enterprise Manager deployments.
Inventory all Enterprise Manager instances and confirm patch level after deployment.
Rotate credentials for high-privileged Enterprise Manager accounts following patch application.
Review recent administrative activity in the Install component for indicators of misuse.

Patch Information

Oracle addresses CVE-2026-46872 in the June 2026 Critical Patch Update. Patch details and download instructions are available in the Oracle Security Alert cspujun2026. Customers running versions 13.5 and 24.1 must apply the corresponding bundle patch.

Workarounds

Restrict network access to the Enterprise Manager HTTPS console to a defined management subnet using firewall rules.
Enforce least privilege on Enterprise Manager accounts and reduce the number of users granted high-privileged roles.
Require multi-factor authentication for all administrative access to the OMS console.
Place the OMS host behind a reverse proxy that enforces source-IP allow listing until patches are deployed.

bash

# Example: restrict access to OMS HTTPS port to a management subnet (Linux firewalld)
firewall-cmd --permanent --zone=drop --add-source=0.0.0.0/0
firewall-cmd --permanent --zone=trusted --add-source=10.50.10.0/24
firewall-cmd --permanent --zone=trusted --add-port=7803/tcp
firewall-cmd --reload