CVE-2026-46985: Oracle Enterprise Manager Disclosure Flaw

CVE-2026-46985 Overview

CVE-2026-46985 is an information disclosure vulnerability in the Oracle Enterprise Manager Base Platform, specifically within the Agent Next Gen component. The flaw affects Oracle Enterprise Manager versions 13.5 and 24.1. An unauthenticated remote attacker with network access via HTTPS can exploit the weakness to gain unauthorized read access to a subset of Oracle Enterprise Manager Base Platform data. The issue is categorized under improper access control [CWE-284]. Oracle disclosed the vulnerability in the Oracle Security Alert July 2026.

Critical Impact
Unauthenticated network attackers can retrieve sensitive Oracle Enterprise Manager data over HTTPS without user interaction, exposing configuration and monitoring information to external adversaries.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Component: Agent Next Gen

Discovery Timeline

2026-07-21 - CVE-2026-46985 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46985

Vulnerability Analysis

The vulnerability resides in the Agent Next Gen component of the Oracle Enterprise Manager Base Platform. Oracle Enterprise Manager is a management platform used to monitor Oracle databases, middleware, and infrastructure. The Agent Next Gen component communicates between managed targets and the Oracle Management Service over HTTPS.

The flaw is easily exploitable and requires no authentication, no privileges, and no user interaction. A successful attack results in unauthorized read access to a subset of data accessible through the platform. Confidentiality is impacted at a low level. Integrity and availability are not affected.

The Exploit Prediction Scoring System (EPSS) score is 0.24% with a percentile of 15.214, indicating a low predicted likelihood of exploitation in the near term. No public proof-of-concept exploit has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper access control [CWE-284] in the Agent Next Gen component. The component fails to enforce sufficient authorization checks on requests reaching specific endpoints over HTTPS. As a result, unauthenticated remote callers can retrieve data that should be restricted to authorized administrators.

Attack Vector

An attacker sends crafted HTTPS requests to a network-reachable Oracle Enterprise Manager Base Platform instance running an affected version of the Agent Next Gen component. Because authentication is not required, the attack surface extends to any instance exposed to untrusted networks. The scope is unchanged, meaning the impact is limited to the vulnerable component itself. Refer to the Oracle Security Alert July 2026 for vendor-specific technical details.

Detection Methods for CVE-2026-46985

Indicators of Compromise

Unauthenticated HTTPS requests to Oracle Enterprise Manager Agent Next Gen endpoints originating from unexpected source IP addresses.
Unusual outbound data flows or response sizes from Oracle Management Service or Agent Next Gen listeners.
Access log entries for management endpoints without corresponding authenticated session identifiers.

Detection Strategies

Inspect Oracle Enterprise Manager HTTPS access logs for anonymous requests to Agent Next Gen endpoints and correlate with source reputation.
Deploy network monitoring rules that alert on requests to Enterprise Manager ports from outside the administrative management network.
Baseline normal Agent Next Gen traffic patterns and flag deviations in request frequency, payload size, and endpoint diversity.

Monitoring Recommendations

Enable verbose access logging on the Oracle Management Service and forward logs to a centralized SIEM for correlation.
Monitor TLS session metadata for connections that terminate without completing an authenticated session.
Track configuration changes on Enterprise Manager hosts and alert on new listeners or exposed ports.

How to Mitigate CVE-2026-46985

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Oracle Enterprise Manager Base Platform 13.5 and 24.1 without delay.
Restrict network access to Enterprise Manager management endpoints to trusted administrative subnets using firewalls or network ACLs.
Review HTTPS access logs for unauthenticated requests to Agent Next Gen endpoints prior to patch deployment.

Patch Information

Oracle addressed CVE-2026-46985 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for patch identifiers, download locations, and installation instructions specific to Enterprise Manager versions 13.5 and 24.1.

Workarounds

Place Oracle Enterprise Manager Base Platform behind a reverse proxy or VPN gateway that enforces authentication before requests reach the Agent Next Gen component.
Apply strict ingress firewall rules limiting access to Enterprise Manager HTTPS ports to known administrative hosts only.
Disable or isolate any Agent Next Gen listeners that are not required for operational monitoring until the patch is deployed.

bash

# Configuration example: restrict Enterprise Manager HTTPS access to admin subnet
# Replace 10.10.0.0/24 with your administrative network range
iptables -A INPUT -p tcp --dport 7803 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7803 -j DROP