Oracle Enterprise Manager CVE-2026-46984

Network access via HTTPS to the Oracle Enterprise Manager Agent Next Gen component on affected versions (13.5 or 24.1) is required. No authentication, no user interaction, and no special configuration are required beyond reachability of the affected endpoint - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms this. Exploitation is limited by network accessibility: in typical enterprise deployments, OEM agents communicate only with the OEM management server on internal networks, substantially reducing exposure to external attackers. The impact is further bounded to read access of a subset of platform data - there is no write, delete, or code execution capability indicated. Non-Oracle database environments running OEM are equally affected regardless of underlying database version.

The CVSS 3.1 score of 5.3 (Medium) is consistent with the limited impact profile: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The attack vector is network, complexity is low, and no privileges or user interaction are required - all signals pointing to trivially automatable exploitation. However, the scope is unchanged and impact is limited strictly to partial confidentiality loss; there is no integrity or availability impact. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantitatively compared. The vulnerability is not listed in CISA KEV, and no public exploit or POC is identified. The real-world risk is primarily one of data reconnaissance: an attacker can enumerate a subset of OEM platform data (potentially including monitored host names, agent configurations, or environment metadata) without authenticating. In environments where OEM agents are internet-facing - which is an atypical but not impossible deployment - this risk increases. In typical enterprise deployments where OEM infrastructure is restricted to internal or management networks, exposure is substantially reduced. The medium CVSS score accurately reflects the bounded impact, but the zero-barrier exploitation conditions mean this should be patched promptly rather than deprioritized on score alone.

An unauthenticated attacker with HTTPS network access to an Oracle Enterprise Manager Agent Next Gen endpoint sends a crafted request to a data-exposing endpoint that should require authentication. Because the authentication check is missing or bypassable, the server returns a subset of OEM platform data - potentially including monitored target metadata, agent configuration details, or environment information - without requiring credentials. No public exploit code is known, but the low complexity and zero-authentication requirement mean this could be replicated through basic HTTP interaction with the agent endpoint.