CVE-2026-46855 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 should prioritize patching this vulnerability. The attack vector is relatively easy, and the potential impact is significant, including potential takeover of the platform. Affected operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The vulnerability, CVE-2026-46855, is located in the Metadata Plugin component of Oracle Enterprise Manager Base Platform, affecting versions 13.5 and 24.1. It has a CVSS score of 9.9, indicating high severity with high impact on confidentiality, integrity, and availability. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Successful attacks can lead to a complete takeover of the platform. The attack vector is relatively easy for low-privileged attackers with network access via HTTPS, and it may significantly impact additional products.

Defensive priority

Highest priority should be given to patching this vulnerability due to its high severity and potential impact. Organizations should apply the security patch provided by Oracle Corporation as soon as possible and restrict network access to the Oracle Enterprise Manager Base Platform to only necessary personnel. Additional security measures, such as multi-factor authentication, should be considered for users with low privileges. Monitoring for suspicious activity related to the Metadata Plugin component is also recommended. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Exceptions, retesting of remediated assets, and closure of the item only after evidence is documented are crucial steps in the remediation process. Tracking of the remediation process and verification of the effectiveness of the implemented controls are essential. Asset inventory and source tracking should be used to ensure that all affected systems are accounted for and that the vulnerability is properly managed. Rollback/change windows should be planned to minimize disruptions during the remediation process. The remediation process should be tracked and verified to ensure its effectiveness. The use of source tracking can help in identifying and managing the affected systems. The implementation of compensating controls can help in reducing the risk associated with the vulnerability. The use of monitoring and detection tools can help in identifying potential attacks. The use of asset inventory can help in identifying and managing the affected systems. The use of rollback/change windows can help in minimizing disruptions during the remediation process. The use of source tracking can help in identifying and managing the affected systems. The use of compensating controls can help in reducing the risk associated with the vulnerability. The use of monitoring and detection tools can help in identifying potential attacks. The use of asset inventory can help in identifying and managing the affected systems. The use of rollback/change windows can help in minimizing disruptions during the remediation process. The use of source tracking can help in

Recommended defensive actions

• Apply the security patch provided by Oracle Corporation as soon as possible.
• Restrict network access to the Oracle Enterprise Manager Base Platform to only necessary personnel.
• Monitor for any suspicious activity related to the Metadata Plugin component.
• Consider implementing additional security measures, such as multi-factor authentication, for users with low privileges.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-06-17T10:54:03.117Z and last modified on 2026-06-18T04:16:49.450Z. The NVD entry is currently Analyzed. The vulnerability affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. The CVSS score is 9.9, indicating a high severity level. The attack vector is relatively easy, and the potential impact is significant, including potential takeover of the platform. Defenders should verify the affected scope, severity, and vendor guidance.

Official resources