CVE-2026-46998: Oracle Enterprise Manager Auth Bypass

CVE-2026-46998 Overview

CVE-2026-46998 is a high-severity vulnerability in the Oracle Enterprise Manager Base Platform, specifically within the Metadata Plugin component. Affected releases include Oracle Enterprise Manager 13.5 and 24.1. An unauthenticated attacker with network access over HTTPS can exploit the flaw, though successful attacks require user interaction from a victim other than the attacker. The weakness is classified under [CWE-601] URL Redirection to Untrusted Site (Open Redirect). Oracle disclosed the issue in the Oracle Critical Patch Update of July 2026. Successful exploitation can result in a full takeover of the Oracle Enterprise Manager Base Platform.

Critical Impact
Successful exploitation enables complete takeover of Oracle Enterprise Manager Base Platform, compromising confidentiality, integrity, and availability of managed enterprise systems.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Oracle Enterprise Manager (component: Metadata Plugin)

Discovery Timeline

2026-07-21 - CVE-2026-46998 published to NVD following the Oracle Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46998

Vulnerability Analysis

The vulnerability resides in the Metadata Plugin component of Oracle Enterprise Manager Base Platform. Oracle classifies it as easily exploitable over the network via HTTPS without authentication. The flaw maps to [CWE-601], indicating that the platform accepts attacker-controlled input used to construct or route redirect destinations. When a legitimate administrator interacts with a crafted link, the platform forwards the session or request flow to an attacker-controlled endpoint. This chain enables credential capture or session abuse that Oracle describes as leading to complete platform takeover.

The scope remains unchanged, meaning the impact is contained to the vulnerable component, but that component manages the entire Oracle Enterprise Manager environment. Consequences include exposure of monitoring data, manipulation of managed target configurations, and disruption of enterprise operations.

Root Cause

The Metadata Plugin fails to validate or restrict redirect and forwarding targets. Attacker-supplied URL parameters flow into response handlers without a domain allowlist or canonicalization step. As a result, the trusted Oracle Enterprise Manager origin issues redirects to arbitrary external hosts, allowing attackers to abuse the platform's implicit trust relationship with authenticated administrators.

Attack Vector

Exploitation requires an unauthenticated attacker to deliver a crafted HTTPS URL that references the vulnerable Oracle Enterprise Manager endpoint. A privileged user, such as an Oracle administrator, must click or otherwise interact with the link. The platform then redirects the browser or client session to attacker-controlled infrastructure, where credentials, tokens, or authentication artifacts can be harvested. The attacker replays these artifacts to gain administrative control of Oracle Enterprise Manager Base Platform.

No verified public exploit code is currently available for CVE-2026-46998. Refer to the Oracle Critical Patch Update July 2026 for authoritative technical details.

Detection Methods for CVE-2026-46998

Indicators of Compromise

Outbound HTTP 302 or 307 responses from Oracle Enterprise Manager endpoints redirecting to unrecognized external domains.
Administrator sessions originating from unexpected IP addresses or geolocations shortly after a phishing lure delivery.
Anomalous Metadata Plugin request parameters containing full URLs, encoded URLs, or protocol-relative references.
New or modified Oracle Enterprise Manager management targets, jobs, or credentials created outside of change windows.

Detection Strategies

Inspect web server and reverse proxy logs for Oracle Enterprise Manager URLs containing redirect, url=, returnUrl=, or similar query parameters pointing to external hosts.
Correlate email gateway telemetry with clicks on Oracle Enterprise Manager URLs to identify phishing campaigns weaponizing the redirect.
Baseline expected redirect targets for the Metadata Plugin and alert on deviations to unapproved domains.

Monitoring Recommendations

Enable verbose HTTPS access logging on all Oracle Enterprise Manager front-end nodes and forward logs to a centralized SIEM.
Monitor administrator authentication events for reuse of session tokens across disparate source addresses.
Track configuration changes and job submissions inside Oracle Enterprise Manager for post-exploitation activity.

How to Mitigate CVE-2026-46998

Immediate Actions Required

Apply the Oracle Critical Patch Update released in July 2026 for Oracle Enterprise Manager 13.5 and 24.1 without delay.
Restrict inbound HTTPS access to the Oracle Enterprise Manager console to trusted administrative network segments only.
Rotate Oracle Enterprise Manager administrator credentials and revoke active sessions after patching.
Brief administrators on phishing risks that leverage trusted Oracle Enterprise Manager URLs.

Patch Information

Oracle addressed CVE-2026-46998 in the Oracle Critical Patch Update July 2026. Administrators should download and apply the patch bundle corresponding to Oracle Enterprise Manager 13.5 or 24.1 following Oracle's documented upgrade procedures. Validate patch application by reviewing the inventory and confirming Metadata Plugin version updates.

Workarounds

Place a reverse proxy or web application firewall in front of Oracle Enterprise Manager to strip or validate redirect parameters until the patch is deployed.
Enforce strict egress filtering on the browsers of administrators who access Oracle Enterprise Manager to limit reachable attacker infrastructure.
Require multi-factor authentication for all Oracle Enterprise Manager accounts to reduce the value of captured credentials.

bash

# Example WAF rule (ModSecurity) blocking external redirect targets on OEM endpoints
SecRule REQUEST_URI "@rx /em/.*" \
  "chain,phase:2,deny,status:403,id:2026046998,\
   msg:'CVE-2026-46998 - external redirect attempt blocked'"
  SecRule ARGS_NAMES "@rx (?i)(url|return|redirect|next|dest)" \
    "chain"
    SecRule ARGS "@rx ^(https?:)?//(?!oem\.internal\.example\.com)" "t:none"