CVE-2026-46990: Oracle Enterprise Manager Auth Bypass Flaw

CVE-2026-46990 Overview

CVE-2026-46990 affects the Oracle Enterprise Manager Base Platform, specifically the Enterprise Config Management component. The flaw exists in supported versions 13.5 and 24.1. An unauthenticated attacker with network access via HTTP can exploit the weakness without user interaction. Successful exploitation permits unauthorized update, insert, or delete operations against a subset of accessible data. Attackers also gain unauthorized read access to a limited data subset and can trigger a partial denial of service. Oracle addressed the issue in the July 2026 Critical Patch Update. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
An unauthenticated remote attacker can compromise confidentiality, integrity, and availability of Oracle Enterprise Manager Base Platform over the network via HTTP.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Enterprise Config Management component

Discovery Timeline

2026-07-21 - CVE-2026-46990 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46990

Vulnerability Analysis

CVE-2026-46990 resides in the Enterprise Config Management component of Oracle Enterprise Manager Base Platform. The attack vector is network-based and does not require authentication or user interaction. An attacker sends crafted HTTP requests to the management platform to reach protected functionality. The result is partial compromise across confidentiality, integrity, and availability. Impacted data includes configuration information managed by the platform, which supports centralized administration of Oracle database and middleware estates.

Exploitation does not lead to full system takeover, but it enables tampering with configuration records and disruption of management services. Because Oracle Enterprise Manager frequently sits at the center of database operations, even partial write access carries operational risk. The Enterprise Config Management component tracks configuration items, compliance data, and change history for managed targets. Manipulation of these records can obscure malicious activity or interfere with compliance reporting. Oracle publishes remediation guidance in the Oracle Security Alert July 2026.

Root Cause

The root cause is improper access control [CWE-284] within the Enterprise Config Management component. Sensitive HTTP endpoints do not enforce authentication or authorization checks before processing requests. This design flaw allows anonymous callers to reach functions that read or modify configuration data.

Attack Vector

The attacker requires only network reachability to the Oracle Enterprise Manager HTTP interface. No credentials, tokens, or user interaction are needed. The attacker issues HTTP requests targeting the vulnerable endpoints exposed by Enterprise Config Management. Because attack complexity is low, automation and mass scanning are practical against internet-exposed or lateral-movement-reachable instances.

No public proof-of-concept or exploit code has been observed. Technical specifics beyond the vendor advisory have not been released.

Detection Methods for CVE-2026-46990

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Enterprise Manager Config Management endpoints from external or unexpected internal sources
Unexplained modifications to configuration records, compliance data, or change history in Enterprise Manager
Availability degradation or partial service interruption in Enterprise Manager without a corresponding operational cause

Detection Strategies

Enable and centralize Oracle Enterprise Manager access logs, then alert on requests to Config Management URLs lacking valid session context
Baseline expected client IPs and user agents contacting the Enterprise Manager console and flag deviations
Correlate HTTP request spikes with configuration change events using SIEM rules

Monitoring Recommendations

Ingest Enterprise Manager repository audit logs into a centralized log platform for continuous review
Monitor for anomalous read patterns against configuration and compliance tables
Track authentication failures and unauthenticated request rates against management URLs

How to Mitigate CVE-2026-46990

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Enterprise Manager Base Platform 13.5 and 24.1 without delay
Restrict network access to Enterprise Manager HTTP and HTTPS listeners so that only authorized administrative subnets can reach them
Review Enterprise Manager audit logs for unauthenticated access attempts since deployment

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the patches to all affected 13.5 and 24.1 deployments. Verify patch application on both the Oracle Management Service and any repository components before returning systems to production.

Workarounds

Place Oracle Enterprise Manager behind a reverse proxy or web application firewall that enforces IP allowlisting on management endpoints
Segment the management network so Enterprise Manager is not reachable from user or internet-facing zones
Disable or restrict any unused Enterprise Config Management interfaces until patching is complete

bash

# Configuration example
# Example iptables rule limiting Enterprise Manager HTTPS access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 7803 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7803 -j DROP