CVE-2026-46997 Overview
CVE-2026-46997 is an authenticated integrity vulnerability in the Oracle Enterprise Manager Base Platform, specifically within the Metadata Plugin component. Affected versions include Oracle Enterprise Manager Base Platform 13.5 and 24.1. A low-privileged attacker with network access over HTTPS can exploit this flaw to gain unauthorized create, modify, or delete access to data managed by the platform. The issue was disclosed in the Oracle Critical Patch Update advisory for July 2026.
Critical Impact
Successful exploitation permits unauthorized creation, deletion, or modification of critical data across all data accessible to Oracle Enterprise Manager Base Platform, without affecting confidentiality or availability.
Affected Products
- Oracle Enterprise Manager Base Platform 13.5
- Oracle Enterprise Manager Base Platform 24.1
- Component: Metadata Plugin
Discovery Timeline
- 2026-07-21 - CVE-2026-46997 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-46997
Vulnerability Analysis
The vulnerability resides in the Metadata Plugin component of Oracle Enterprise Manager Base Platform. Oracle characterizes the issue as easily exploitable by an attacker who already holds low privileges within the platform. The attack traverses the network via HTTPS, meaning any authenticated user reachable to the management console can attempt exploitation.
The impact is scoped entirely to integrity. An attacker cannot read protected data or force a denial of service, but they can create, alter, or delete records the plugin exposes. Because Enterprise Manager governs monitoring policies, agent configurations, and metadata for downstream databases and middleware, tampering can cascade into misreported telemetry, disabled monitoring, or corrupted configuration baselines.
Oracle has not published a CWE classification or detailed root cause description for this issue. The EPSS score at time of publication is 0.238% (percentile 14.9), indicating low near-term exploitation likelihood.
Root Cause
Oracle's advisory does not disclose the underlying defect. Based on the CVSS metrics, the flaw permits an authenticated user to perform write operations against metadata objects that should be restricted, suggesting broken access control or missing authorization checks in the plugin's request handlers. Refer to the Oracle Security Alert July 2026 for the authoritative advisory.
Attack Vector
The attack vector is network-based over HTTPS to the Enterprise Manager management endpoint. The attacker must possess a valid low-privileged account. No user interaction is required, and attack complexity is low. Exploitation does not require chaining with other vulnerabilities to achieve the described integrity impact.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-46997
Indicators of Compromise
- Unexpected creation, modification, or deletion of metadata objects, monitoring templates, or plugin configurations within Oracle Enterprise Manager.
- Authenticated HTTPS requests to Metadata Plugin endpoints originating from accounts that do not typically perform administrative changes.
- Audit log entries showing metadata write operations from low-privileged user roles.
Detection Strategies
- Enable and review Enterprise Manager audit logging for all metadata create, update, and delete operations.
- Baseline normal administrative activity per account and alert on deviations against Metadata Plugin operations.
- Correlate HTTPS access logs on the Oracle Management Service (OMS) with authenticated session identifiers to identify anomalous request patterns.
Monitoring Recommendations
- Forward OMS access logs and Enterprise Manager audit records to a centralized SIEM for retention and correlation.
- Monitor for privilege changes and new low-privileged account creation preceding metadata modification activity.
- Alert on out-of-window changes to monitoring templates, agent policies, or plugin metadata.
How to Mitigate CVE-2026-46997
Immediate Actions Required
- Apply the Oracle Critical Patch Update dated July 2026 to Enterprise Manager Base Platform 13.5 and 24.1 deployments.
- Inventory all accounts with access to the Enterprise Manager console and remove or downgrade unused low-privileged accounts.
- Rotate credentials for service accounts that interact with the Metadata Plugin.
Patch Information
Oracle addressed this vulnerability in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 for patch identifiers applicable to Enterprise Manager Base Platform 13.5 and 24.1, then apply the updates through the standard OPatch workflow.
Workarounds
- Restrict network access to the Enterprise Manager console to trusted management networks and VPN segments only.
- Enforce least-privilege role assignments and remove Metadata Plugin write permissions from accounts that do not require them.
- Enable multi-factor authentication for all Enterprise Manager accounts to raise the cost of credential-based access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
