CVE-2026-46995: Oracle Enterprise Manager Privilege Escalation

CVE-2026-46995 Overview

CVE-2026-46995 is a privilege management vulnerability [CWE-269] in the Oracle Enterprise Manager Base Platform, within the Metadata Plugin component. The flaw affects supported versions 13.5 and 24.1. A low-privileged attacker with network access over HTTPS can exploit this vulnerability to compromise the platform. Successful exploitation results in full takeover of Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability.

Critical Impact
Authenticated attackers with minimal privileges can take over Oracle Enterprise Manager Base Platform, gaining control over managed database and middleware infrastructure.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Metadata Plugin component

Discovery Timeline

2026-07-21 - CVE-2026-46995 published to NVD as part of the Oracle Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46995

Vulnerability Analysis

CVE-2026-46995 resides in the Metadata Plugin component of Oracle Enterprise Manager Base Platform. The weakness maps to [CWE-269] Improper Privilege Management, indicating that the affected component fails to correctly enforce privilege boundaries between authenticated users and administrative functions.

An attacker who already holds valid low-privileged credentials can leverage exposed HTTPS interfaces to escalate access. Because Enterprise Manager centrally administers Oracle databases, Fusion Middleware, and cloud infrastructure, a successful takeover cascades into the managed estate. The EPSS score of 0.447% reflects a currently low predicted exploitation likelihood, but the ease of exploitation and platform criticality raise the effective operational risk.

Root Cause

The root cause is improper privilege management within the Metadata Plugin. The component does not adequately verify whether the calling principal is authorized to invoke privileged metadata operations. Oracle has not published implementation-level details in the public advisory.

Attack Vector

The attack originates over the network across HTTPS. The attacker must possess a valid low-privileged account on the target instance. No user interaction is required, and the attack complexity is low. Exploitation impacts confidentiality, integrity, and availability at the host scope.

No verified public proof-of-concept code is available. See the Oracle Critical Patch Update - July 2026 for vendor guidance.

Detection Methods for CVE-2026-46995

Indicators of Compromise

Unexpected privileged actions performed by low-privileged Enterprise Manager accounts, including metadata edits, plugin deployment, or credential changes.
HTTPS requests to Metadata Plugin endpoints originating from unusual internal or external hosts.
New administrative sessions, target additions, or job executions that do not correspond to authorized change tickets.

Detection Strategies

Audit SYSMAN and Enterprise Manager repository logs for privilege changes and role assignments made by non-administrative users.
Correlate authentication logs with subsequent metadata modifications to identify vertical privilege escalation patterns.
Baseline normal Metadata Plugin API usage and alert on deviations in request volume, source IP, or endpoint access.

Monitoring Recommendations

Forward Oracle Enterprise Manager audit logs, OHS access logs, and repository database audit trails to a centralized SIEM for continuous review.
Monitor for job submissions, agent deployments, and credential set changes outside standard maintenance windows.
Alert on failed followed by successful authentication sequences against Enterprise Manager consoles.

How to Mitigate CVE-2026-46995

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Enterprise Manager Base Platform 13.5 and 24.1 without delay.
Inventory all Enterprise Manager instances and confirm patch level using OPatch and emctl version checks.
Rotate Enterprise Manager administrative and repository credentials after patching.
Review recent audit logs for signs of privilege escalation preceding the patch window.

Patch Information

Oracle addressed CVE-2026-46995 in the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update Advisory - July 2026 for patch identifiers and installation procedures for Enterprise Manager 13.5 and 24.1.

Workarounds

Restrict network access to Enterprise Manager consoles and Metadata Plugin endpoints to trusted management networks using firewall or reverse-proxy allowlists.
Enforce least privilege on Enterprise Manager accounts and remove unused low-privileged users pending patch deployment.
Require multi-factor authentication for all Enterprise Manager console access via the front-end identity provider.
Increase audit logging verbosity on the repository database and Metadata Plugin operations until patching is complete.

bash

# Verify installed patches on Oracle Enterprise Manager
$ORACLE_HOME/OPatch/opatch lsinventory | grep -i "Patch"

# Check Enterprise Manager version
emctl status oms -details

# Restrict console access at the OHS layer (example)
# Edit $ORACLE_HOME/user_projects/domains/GCDomain/config/fmwconfig/components/OHS/instances/ohs1/httpd.conf
<Location /em>
    Require ip 10.0.0.0/8
    Require ip 192.168.10.0/24
</Location>