CVE-2026-46987: Oracle Enterprise Manager Auth Bypass Flaw

CVE-2026-46987 Overview

CVE-2026-46987 is an access control vulnerability [CWE-284] in the Oracle Enterprise Manager Base Platform, specifically within the Application Service Level Management component. The flaw affects supported versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can exploit this weakness to gain unauthorized access to critical data stored within the platform. The vulnerability introduces a scope change, meaning successful exploitation can impact additional Oracle products beyond the initially affected component. Oracle disclosed the issue in the Oracle Security Alert for July 2026.

Critical Impact
Successful exploitation grants unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data, with cross-product impact due to the scope change.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Application Service Level Management component

Discovery Timeline

2026-07-21 - CVE-2026-46987 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database
July 2026 - Disclosed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-46987

Vulnerability Analysis

The vulnerability resides in the Application Service Level Management component of Oracle Enterprise Manager Base Platform. It is classified as an Improper Access Control weakness [CWE-284]. An authenticated attacker with low privileges can send crafted HTTPS requests to reach functionality or data that should be restricted to higher-privileged roles. The scope change indicator confirms that exploitation crosses a security boundary. Attacks originating in Enterprise Manager Base Platform can affect data managed by additional Oracle products integrated with the platform. Confidentiality is the sole impacted security property, with integrity and availability unaffected.

Root Cause

The root cause is improper enforcement of access control checks within the Application Service Level Management component. The component fails to validate the privilege level of the requester before disclosing managed data. Because Enterprise Manager aggregates telemetry and operational data from downstream targets, the missing authorization check exposes information belonging to those targets.

Attack Vector

The attack vector is network-based over HTTPS. An attacker requires only low-privileged authenticated access to the Enterprise Manager instance. No user interaction is required, and the attack complexity is low. Public exploit code is not currently available, and the EPSS score is 0.27%, placing it in the 18.9th percentile for exploitation likelihood.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert July 2026 for vendor-provided technical details.

Detection Methods for CVE-2026-46987

Indicators of Compromise

Unexpected HTTPS requests to Application Service Level Management endpoints from accounts with low administrative privilege.
Enterprise Manager audit log entries showing data retrieval operations inconsistent with the account role.
Anomalous access patterns to targets managed by Enterprise Manager originating from a single low-privileged session.

Detection Strategies

Enable and centralize Oracle Enterprise Manager audit logging, focusing on Application Service Level Management endpoints and privileged data access.
Baseline normal API and console activity per user role, and alert on deviations such as bulk data reads by low-privileged accounts.
Correlate Enterprise Manager access logs with authentication events to identify credential misuse.

Monitoring Recommendations

Forward Enterprise Manager and web tier logs to a centralized SIEM for correlation and long-term retention.
Monitor for repeated HTTPS requests to Service Level Management URLs from non-administrative accounts.
Review privileged data access reports weekly until the July 2026 CPU patch is fully deployed.

How to Mitigate CVE-2026-46987

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update July 2026 to all Enterprise Manager 13.5 and 24.1 deployments.
Inventory all Enterprise Manager instances, including non-production environments, and prioritize internet-adjacent systems.
Review and reduce the number of low-privileged accounts that can authenticate to Enterprise Manager.

Patch Information

Oracle addressed CVE-2026-46987 in the July 2026 Critical Patch Update. Administrators should download and apply the patch bundle corresponding to Enterprise Manager Base Platform versions 13.5 and 24.1. Details, patch numbers, and prerequisite steps are published in the Oracle Security Alert July 2026.

Workarounds

Restrict network access to the Enterprise Manager console and APIs using network segmentation or firewall rules until the patch is applied.
Enforce least privilege on Enterprise Manager accounts and remove unused low-privileged users.
Require multi-factor authentication for all Enterprise Manager logins to reduce the risk of credential-based access.

bash

# Example: restrict Enterprise Manager console access to a management subnet
iptables -A INPUT -p tcp --dport 7803 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7803 -j DROP