Oracle Enterprise Manager APM CVE-2026-46858

The attacker needs only network HTTP reachability to the Oracle Management Service of an Enterprise Manager 13.5 or 24.1 deployment with the APM - Application Performance Management plug-in (specifically the JADM / JVM Diagnostics component) installed and enabled; no credentials, no user interaction, and no special client configuration are required (PR:N/UI:N/AC:L). Real-world exploitation is limited by Oracle's typical deployment pattern in which OMS HTTP ports sit on a restricted management network, and by the requirement that the JVMD/JADM subcomponent specifically be active - sites running OEM without the APM plug-in are not exposed to this CVE.

Signals are mixed but lean toward elevated priority for any organization that exposes OEM APM beyond the management network. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is maximally favorable to an attacker and the 9.1 score reflects full integrity and availability loss; however confidentiality is explicitly N, so this is a tampering/DoS issue rather than a data-theft issue. No EPSS score, KEV listing, or public POC was supplied in the input, and no SSVC decision was provided, so probability of mass exploitation cannot be quantified - only feasibility. Practically, OEM is typically deployed inside the management VLAN with restricted ingress, which substantially lowers real-world exposure versus the raw 9.1 implies; conversely, where OEM is reachable from broader internal networks (a common reality), an unauthenticated attacker can silently corrupt monitoring data or knock the APM tier offline, defeating the very observability that incident responders rely on.

An attacker who can reach the OMS HTTP listener - for example a foothold on any host inside the management VLAN, or any internal user network that was inadvertently allowed to the OEM console - sends crafted HTTP requests to the JVMD / JADM endpoint and either rewrites APM monitoring records (poisoning dashboards and alert thresholds so real incidents go unnoticed) or triggers a repeatable crash of the APM tier, blinding the operations team during a follow-on attack. No public exploit identified at time of analysis, but the trivial attack complexity and unauthenticated network vector make a working exploit straightforward to develop once the patch is diffed.