Oracle Enterprise Manager CVE-2026-46866

Exploitation requires network reachability to the OEM Management Service HTTPS listener used by the Agent Next Gen component on a host running Oracle Enterprise Manager Base Platform 13.5 or 24.1; no credentials, user interaction, or non-default configuration are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). What limits exploitation in practice is that OEM OMS endpoints are typically deployed on an internal management network rather than the public internet, so an attacker generally needs a foothold inside that segment or access via a compromised managed host. The flaw does not yield code execution or confidentiality loss - impact is bounded to DoS of the console and partial unauthorized modification of OEM-accessible data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) is severe on paper: network-reachable, low complexity, no authentication, no user interaction, with complete availability loss and partial integrity impact. However, EPSS data was not supplied, the CVE is not on CISA KEV, and no public POC is referenced - so the realistic threat tier is 'high-CVSS, exploitation-unproven' at this point. The Agent Next Gen channel is normally segmented to the management network rather than exposed on the public internet, which materially lowers real-world exploitability for most deployments; teams that publish OEM endpoints externally or run flat management networks face the full CVSS-implied risk. Because OEM holds privileged credentials to managed databases, an integrity-tampering primitive plus DoS on the console is a meaningful operational and audit-integrity concern even if not RCE.

An attacker who can reach the OEM Management Service HTTPS upload port (typically because the management network is reachable from a compromised workstation, jump host, or misrouted VLAN) sends a crafted HTTPS request to the Agent Next Gen endpoint, repeatedly crashing the OMS process and producing a complete denial of service for the monitoring console. In the same campaign the attacker uses the integrity-tampering primitive to alter a subset of OEM-accessible data - for example silencing alerts, modifying monitoring thresholds, or planting misleading records - to mask follow-on activity against managed databases. No public POC is currently identified, so the scenario is plausible but not yet observed in the wild.