CVE-2026-46994: Oracle Enterprise Manager Auth Bypass Flaw

CVE-2026-46994 Overview

CVE-2026-46994 is a critical vulnerability in the Oracle Enterprise Manager Base Platform, specifically within the Agent Next Gen component. The flaw affects supported versions 13.5 and 24.1. An unauthenticated attacker with network access over HTTPS can exploit this issue to fully compromise the affected system. Successful exploitation results in complete takeover of the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability. Oracle disclosed the vulnerability in the July 2026 Critical Patch Update. The weakness is classified under CWE-284 (Improper Access Control).

Critical Impact
An unauthenticated remote attacker can take over Oracle Enterprise Manager Base Platform via HTTPS without user interaction, gaining full control of monitored infrastructure.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Component: Agent Next Gen

Discovery Timeline

2026-07-21 - CVE-2026-46994 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update

Technical Details for CVE-2026-46994

Vulnerability Analysis

The vulnerability resides in the Agent Next Gen component of Oracle Enterprise Manager Base Platform. Oracle Enterprise Manager is the primary management console used by administrators to monitor and control Oracle databases, middleware, and infrastructure. The Agent Next Gen component communicates with the Oracle Management Server (OMS) over HTTPS and handles telemetry, job execution, and configuration tasks.

An attacker with network access to the HTTPS interface can exploit the flaw without prior authentication and without user interaction. Successful exploitation yields full takeover of the platform, giving the attacker control over all managed targets registered with the compromised Enterprise Manager instance. This scope includes production databases, application servers, and monitored hosts.

Root Cause

Oracle's advisory maps the weakness to improper access control [CWE-284]. The Agent Next Gen component fails to properly enforce authorization checks on requests received over its HTTPS interface. Oracle has not published exploitation technique details, consistent with its Critical Patch Update disclosure policy.

Attack Vector

The attack vector is network-based and requires only HTTPS reachability to the vulnerable Agent Next Gen endpoint. No credentials, privileges, or user interaction are required. The EPSS score is 0.358% (28th percentile) at time of publication, and no public proof-of-concept exploit has been observed. However, the low attack complexity and unauthenticated access make this a high-priority patching target for Oracle Enterprise Manager operators.

Refer to the Oracle Critical Patch Update Advisory - July 2026 for authoritative technical details.

Detection Methods for CVE-2026-46994

Indicators of Compromise

Unexpected inbound HTTPS connections to Enterprise Manager agent ports from unknown source IPs.
New or modified administrative accounts within Oracle Enterprise Manager not tied to a change ticket.
Unscheduled jobs, blackout windows, or configuration changes issued through the Agent Next Gen component.
Outbound connections from OMS or agent hosts to unfamiliar external endpoints following exposure of the HTTPS listener.

Detection Strategies

Inventory all Oracle Enterprise Manager 13.5 and 24.1 installations and confirm exposure of the Agent Next Gen HTTPS listener.
Baseline normal agent-to-OMS traffic and alert on unusual request volumes, sources, or user-agent strings.
Correlate authentication logs, EM audit logs, and network telemetry to identify unauthenticated administrative actions.

Monitoring Recommendations

Enable and forward Oracle Enterprise Manager audit logs to a centralized log platform for review.
Monitor host-level process creation on OMS and agent servers for unexpected shells or scripting engines spawned by the agent process.
Track file integrity on Enterprise Manager configuration directories and agent binaries.

How to Mitigate CVE-2026-46994

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Enterprise Manager 13.5 and 24.1 deployments without delay.
Restrict network reachability to the Agent Next Gen HTTPS interface using firewall rules and network segmentation.
Audit Enterprise Manager accounts, jobs, and target registrations for unauthorized changes prior to patching.
Rotate credentials for any accounts managed or accessed through the affected Enterprise Manager instances.

Patch Information

Oracle addressed CVE-2026-46994 in the July 2026 Critical Patch Update. Administrators should review the Oracle Critical Patch Update Advisory - July 2026 for patch identifiers, download locations, and version-specific installation instructions for Oracle Enterprise Manager Base Platform 13.5 and 24.1.

Workarounds

Limit Enterprise Manager HTTPS listener exposure to management VLANs and jump hosts only.
Terminate inbound connections at a reverse proxy that enforces client certificate authentication until patches are applied.
Temporarily disable non-essential Agent Next Gen features if operational tolerance allows, pending patch deployment.

bash

# Example: restrict access to Enterprise Manager agent HTTPS listener to management subnet
iptables -A INPUT -p tcp --dport 3872 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3872 -j DROP