CVE-2026-46986: Oracle Enterprise Manager Info Disclosure

CVE-2026-46986 Overview

CVE-2026-46986 is an access control vulnerability [CWE-284] in the Agent Next Gen component of Oracle Enterprise Manager Base Platform. The flaw affects supported versions 13.5 and 24.1. An unauthenticated attacker with network access via HTTPS can exploit the vulnerability without user interaction. Successful exploitation grants unauthorized read access to a subset of Oracle Enterprise Manager Base Platform data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can read a subset of Oracle Enterprise Manager Base Platform data over HTTPS, exposing configuration and monitoring information.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Component: Agent Next Gen

Discovery Timeline

2026-07-21 - CVE CVE-2026-46986 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle releases fix in the July 2026 Critical Patch Update

Technical Details for CVE-2026-46986

Vulnerability Analysis

The vulnerability resides in the Agent Next Gen component of Oracle Enterprise Manager Base Platform. Oracle Enterprise Manager (OEM) agents collect telemetry, configuration, and performance data from managed targets across an enterprise environment. The Agent Next Gen module exposes HTTPS endpoints that participate in agent-to-OMS (Oracle Management Server) communication. Improper access control [CWE-284] on one or more of these endpoints allows requests to succeed without authentication. The impact is limited to confidentiality, with no integrity or availability effects reported by Oracle.

Root Cause

The root cause is improper access control on network-facing functionality in the Agent Next Gen component. The affected code path does not enforce authentication or authorization checks before returning data. Because Enterprise Manager aggregates data across many managed systems, disclosure from a single agent endpoint can expose information about multiple hosts, databases, or middleware targets.

Attack Vector

Exploitation requires only network reachability to the Enterprise Manager HTTPS interface. No credentials, privileges, or user interaction are needed. An attacker sends crafted HTTPS requests to affected endpoints on Enterprise Manager Base Platform 13.5 or 24.1. The server returns a subset of accessible data in response. See the Oracle July 2026 Security Alert for advisory details.

No public proof-of-concept code is available. No verified exploit code exists in public repositories, so this article describes the mechanism in prose only.

Detection Methods for CVE-2026-46986

Indicators of Compromise

Unauthenticated HTTPS requests to Oracle Enterprise Manager Agent Next Gen endpoints from unexpected source addresses.
Responses to unauthenticated clients that return 200 OK with monitoring, configuration, or target metadata payloads.
Anomalous volumes of GET requests against agent endpoints outside of scheduled OMS polling intervals.

Detection Strategies

Review web server and reverse proxy logs on Enterprise Manager hosts for successful HTTPS responses to unauthenticated requests.
Compare source IP addresses of Agent Next Gen requests against the known list of Oracle Management Server hosts.
Alert on any external or non-management network address reaching the Enterprise Manager Base Platform HTTPS listener.

Monitoring Recommendations

Ingest Enterprise Manager access logs into a centralized logging platform for correlation with network telemetry.
Baseline normal request patterns from OMS to agents, then alert on deviations in path, volume, or client identity.
Monitor for scanner signatures targeting Oracle CPU July 2026 advisories against management infrastructure.

How to Mitigate CVE-2026-46986

Immediate Actions Required

Apply the July 2026 Critical Patch Update for Oracle Enterprise Manager Base Platform versions 13.5 and 24.1.
Inventory all Enterprise Manager Base Platform deployments and verify patch status against the Oracle advisory.
Restrict network access to Enterprise Manager HTTPS listeners so only authorized OMS and agent hosts can connect.

Patch Information

Oracle addressed CVE-2026-46986 in the July 2026 Critical Patch Update. Administrators should follow the guidance published in the Oracle July 2026 Security Alert and apply the corresponding patches to Enterprise Manager Base Platform 13.5 and 24.1 installations.

Workarounds

Place Enterprise Manager Base Platform behind a network segment restricted to management traffic only.
Enforce firewall or ACL rules that limit HTTPS access to the Agent Next Gen component to trusted OMS hosts.
Terminate TLS at a reverse proxy that requires mutual TLS or additional authentication before forwarding to Enterprise Manager.

bash

# Example: restrict access to Enterprise Manager HTTPS port with iptables
iptables -A INPUT -p tcp --dport 3872 -s <OMS_IP>/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 3872 -j DROP