CVE-2026-46999: Oracle Enterprise Manager Auth Bypass Flaw

CVE-2026-46999 Overview

CVE-2026-46999 is a high-severity vulnerability in the Discovery Framework component of Oracle Enterprise Manager Base Platform. The flaw affects supported versions 13.5 and 24.1. An unauthenticated attacker with network access over HTTPS can exploit this vulnerability to compromise the Oracle Enterprise Manager Base Platform.

Critical Impact
Successful exploitation allows unauthorized creation, deletion, or modification of critical data across all accessible Oracle Enterprise Manager Base Platform data. Attackers can also read a subset of data and cause a partial denial of service.

Affected Products

Oracle Enterprise Manager Base Platform 13.5
Oracle Enterprise Manager Base Platform 24.1
Component: Discovery Framework

Discovery Timeline

2026-07-21 - CVE-2026-46999 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-46999

Vulnerability Analysis

The vulnerability resides in the Discovery Framework component of Oracle Enterprise Manager Base Platform. The Discovery Framework is responsible for identifying and cataloguing managed targets across enterprise environments. A flaw in how the framework processes HTTPS-based requests permits an unauthenticated attacker to interact with functionality that should be gated by authentication controls.

Successful exploitation grants attackers write access to critical data managed by Enterprise Manager. This includes the ability to create, modify, or delete records that Oracle Enterprise Manager Base Platform can access. Attackers also gain limited read access to a subset of managed data and can induce a partial denial of service. Oracle rates the exploitation complexity as high, meaning specific conditions outside the attacker's control must be present for reliable exploitation.

Root Cause

Oracle has not published detailed root-cause information. Based on the impact profile documented in the Oracle Security Alert July 2026, the weakness allows unauthenticated network requests to reach privileged Discovery Framework operations. The high integrity impact with lower confidentiality impact suggests the affected code path permits data manipulation without properly validating the requester's identity.

Attack Vector

Exploitation requires only network access to the Enterprise Manager HTTPS interface. No authentication, credentials, or user interaction are required. Because Oracle Enterprise Manager is often deployed to manage database estates and infrastructure fleets, a compromised instance can affect the operational integrity of downstream managed systems. Verified technical details are limited to the vendor advisory; consult the Oracle Security Alert July 2026 for authoritative guidance.

Detection Methods for CVE-2026-46999

Indicators of Compromise

Unexpected HTTPS requests to Oracle Enterprise Manager Discovery Framework endpoints originating from untrusted network segments.
Unauthorized creation, modification, or deletion events in Enterprise Manager management repositories.
Anomalous target registration, deregistration, or configuration changes not tied to a legitimate administrator session.
Partial service degradation or repeated restarts of Enterprise Manager services without operational cause.

Detection Strategies

Review Enterprise Manager audit logs (emctl audit and repository audit tables) for administrative actions lacking a matching authenticated session.
Correlate web server access logs for the OMS with authentication events to identify unauthenticated requests reaching Discovery Framework URIs.
Baseline expected discovery activity and alert on volume spikes or requests from atypical source addresses.

Monitoring Recommendations

Forward Oracle Enterprise Manager OMS logs, emctl logs, and repository audit data to a centralized SIEM for correlation.
Monitor for privileged operations on management targets that occur outside of change windows.
Track HTTPS traffic patterns to the OMS console and flag connections from sources outside authorized administrative subnets.

How to Mitigate CVE-2026-46999

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 without delay.
Restrict network access to the Oracle Management Service (OMS) HTTPS listener to authorized administrative networks only.
Audit recent changes to managed target inventories and repository data for signs of unauthorized modification.

Patch Information

Oracle addressed CVE-2026-46999 in the July 2026 Critical Patch Update. Administrators should download and apply the fixes referenced in the Oracle Security Alert July 2026 for the affected Enterprise Manager versions.

Workarounds

Place the Oracle Management Service behind a reverse proxy or WAF that enforces source IP restrictions and authenticates traffic before it reaches the Discovery Framework.
Segment the Enterprise Manager infrastructure from general corporate networks and internet-facing zones.
Increase audit logging verbosity on the OMS and management repository until the patch is applied.

bash

# Configuration example: verify installed Enterprise Manager version and apply CPU
$ORACLE_HOME/bin/emctl status oms -details
$ORACLE_HOME/OPatch/opatch lspatches
$ORACLE_HOME/OPatch/opatch apply <July2026_CPU_patch_directory>