CVE-2026-46984: Oracle Enterprise Manager Info Disclosure

CVE-2026-46984 Overview

CVE-2026-46984 is an improper access control flaw [CWE-284] in the Oracle Enterprise Manager Base Platform, specifically within the Agent Next Gen component. The vulnerability affects supported versions 13.5 and 24.1. An unauthenticated attacker with network access over HTTPS can exploit this issue to gain unauthorized read access to a subset of data accessible to the Oracle Enterprise Manager Base Platform. Oracle disclosed the flaw as part of the July 2026 Critical Patch Update. No public exploit code or evidence of in-the-wild exploitation has been reported at the time of publication.

Critical Impact
Unauthenticated remote attackers can read a subset of Oracle Enterprise Manager Base Platform data over HTTPS without user interaction.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Component: Agent Next Gen

Discovery Timeline

2026-07-21 - CVE-2026-46984 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-46984

Vulnerability Analysis

The vulnerability resides in the Agent Next Gen component of Oracle Enterprise Manager Base Platform. It is classified under [CWE-284] Improper Access Control. The flaw permits an unauthenticated attacker to interact with the affected service over HTTPS without any credentials or user interaction. Successful exploitation yields unauthorized read access to a subset of data managed by the platform. The confidentiality impact is limited, and neither integrity nor availability is affected. Because Enterprise Manager centrally administers Oracle database and middleware fleets, even partial data disclosure can expose configuration details, inventory information, or operational metadata useful for follow-on attacks.

Root Cause

The root cause is improper access control in the Agent Next Gen component. The service does not adequately enforce authentication or authorization checks on specific request paths, allowing anonymous callers to retrieve data that should be restricted to authorized users.

Attack Vector

Exploitation requires only network reachability to the Enterprise Manager HTTPS endpoint. The attacker sends crafted HTTPS requests to the Agent Next Gen interface. No privileges, credentials, or user interaction are needed. The attack complexity is low, making the flaw straightforward to weaponize once the endpoint is exposed. Environments that expose Enterprise Manager beyond trusted management networks face the highest risk.

No public proof-of-concept code has been released. Technical specifics beyond Oracle's advisory are not available. See the Oracle Critical Patch Update July 2026 for vendor guidance.

Detection Methods for CVE-2026-46984

Indicators of Compromise

Unauthenticated HTTPS requests to Agent Next Gen endpoints originating from external or non-management network segments.
Anomalous response sizes or high request volumes on Enterprise Manager Agent ports from a single source.
Access log entries lacking associated authenticated session identifiers on Enterprise Manager URIs.

Detection Strategies

Enable verbose HTTP access logging on Oracle Enterprise Manager and correlate requests targeting Agent Next Gen paths with authentication events.
Baseline normal management traffic patterns and alert on requests from non-management source addresses.
Deploy web application firewall or reverse proxy rules that flag anonymous requests to Enterprise Manager endpoints.

Monitoring Recommendations

Forward Enterprise Manager access, audit, and agent logs to a centralized SIEM for correlation.
Monitor for scanning behavior targeting Oracle Enterprise Manager default ports (typically 7799, 4903, 4889).
Track configuration changes and information retrieval events on managed targets that follow unauthenticated access patterns.

How to Mitigate CVE-2026-46984

Immediate Actions Required

Inventory all Oracle Enterprise Manager Base Platform 13.5 and 24.1 deployments and identify the affected Agent Next Gen component.
Apply the July 2026 Oracle Critical Patch Update on all affected instances as the primary remediation.
Restrict network access to Enterprise Manager HTTPS interfaces to trusted management subnets only.
Review access logs for anomalous unauthenticated activity preceding the patch application.

Patch Information

Oracle addressed CVE-2026-46984 in the Oracle Critical Patch Update released July 2026. Administrators should download and apply the vendor-supplied patch for their Enterprise Manager version. Refer to the Oracle Critical Patch Update July 2026 advisory for patch identifiers, download links, and installation prerequisites.

Workarounds

Place Enterprise Manager consoles and Agent Next Gen endpoints behind a network access control list that permits only authorized administrator hosts.
Terminate HTTPS at a reverse proxy that enforces client certificate authentication or mutual TLS in front of Enterprise Manager.
Disable or firewall off the Agent Next Gen interface if it is not required in the environment until patching is complete.

bash

# Example: restrict Enterprise Manager HTTPS access to a management subnet using iptables
iptables -A INPUT -p tcp --dport 7799 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7799 -j DROP