CVE-2026-46992: Oracle Enterprise Manager Escalation Flaw

CVE-2026-46992 Overview

CVE-2026-46992 affects the Oracle Enterprise Manager Base Platform within Oracle Enterprise Manager, specifically the Enterprise Config Management component. Oracle addressed the flaw in the July 2026 Critical Patch Update. Supported versions 13.5 and 24.1 are affected.

A low-privileged attacker with network access via HTTPS can exploit this vulnerability to take over the Oracle Enterprise Manager Base Platform. Successful exploitation compromises confidentiality, integrity, and availability of the target system.

Critical Impact
Authenticated attackers with minimal privileges can achieve complete takeover of Oracle Enterprise Manager Base Platform over the network, exposing managed database and middleware infrastructure to full compromise.

Affected Products

Oracle Enterprise Manager Base Platform version 13.5
Oracle Enterprise Manager Base Platform version 24.1
Enterprise Config Management component

Discovery Timeline

2026-07-21 - CVE-2026-46992 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle addressed the vulnerability in the Oracle July 2026 Security Alert

Technical Details for CVE-2026-46992

Vulnerability Analysis

The vulnerability resides in the Enterprise Config Management component of Oracle Enterprise Manager Base Platform. Enterprise Config Management handles configuration data collection, comparison, and change tracking across Oracle-managed targets. A flaw in this component permits an authenticated user to escalate access beyond their assigned scope.

The attack does not require user interaction and can be executed remotely over HTTPS. Oracle rates the issue as easily exploitable, meaning a working attack path is achievable without specialized conditions. The scope remains unchanged, but the impact reaches all three security properties at the high level.

An attacker who compromises Oracle Enterprise Manager gains a management foothold across every registered database, WebLogic server, and Fusion Middleware target. This transforms a single account compromise into an infrastructure-wide incident.

Root Cause

Oracle has not published detailed root cause information for CVE-2026-46992. The affected component handles configuration objects, so common failure modes include broken access control on privileged operations or unsafe processing of user-controlled configuration content. Refer to the Oracle July 2026 Security Alert for vendor guidance.

Attack Vector

The attacker requires an authenticated session with low privileges on the target Oracle Enterprise Manager instance. The attacker sends crafted HTTPS requests to the Enterprise Config Management interface. Successful exploitation grants control over the Oracle Enterprise Manager Base Platform itself, which typically manages downstream databases and middleware.

Oracle has not disclosed proof-of-concept code, and no public exploit is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-46992

Indicators of Compromise

Unexpected configuration collection or comparison jobs initiated by low-privileged Enterprise Manager accounts.
Anomalous HTTPS requests to Enterprise Config Management endpoints from unusual source addresses.
New administrative roles, targets, or credentials created outside of scheduled change windows.
Modifications to Enterprise Manager repository tables or preferred credentials without a corresponding change ticket.

Detection Strategies

Review Oracle Enterprise Manager audit logs for privilege changes, target additions, and credential access by non-administrative users.
Correlate WebLogic access logs on the OMS tier with authentication events to identify session anomalies.
Alert on Enterprise Config Management API calls issued at rates or times inconsistent with baseline administrator behavior.

Monitoring Recommendations

Forward Enterprise Manager sysman audit logs and OMS access logs to a central SIEM for retention and correlation.
Monitor outbound connections from OMS hosts to managed targets for unexpected credential use.
Track file integrity on Enterprise Manager configuration directories and repository schemas.

How to Mitigate CVE-2026-46992

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all affected Enterprise Manager 13.5 and 24.1 deployments.
Restrict network reachability of the Oracle Management Service HTTPS endpoints to trusted administrative networks.
Audit Enterprise Manager user accounts and remove or downgrade unused low-privileged accounts.
Rotate preferred credentials and named credentials stored within the Enterprise Manager repository after patching.

Patch Information

Oracle released the fix as part of the Oracle July 2026 Security Alert. Administrators should follow Oracle's documented OMSPatcher and OPatch procedures to apply the bundle patch to the Oracle Management Service and repository.

Workarounds

Oracle has not published a supported workaround; patching remains the required remediation.
Where immediate patching is not feasible, place the Oracle Management Service behind a reverse proxy that enforces mutual TLS and source IP restrictions.
Enforce multi-factor authentication for all Enterprise Manager console access through the integrated identity provider.

bash

# Verify installed Enterprise Manager patch inventory after applying the July 2026 CPU
$ORACLE_HOME/OPatch/opatch lspatches
$ORACLE_HOME/OMSPatcher/omspatcher lspatches