Oracle Enterprise Manager CVE-2026-46985

The vulnerability requires HTTPS network reachability to Oracle Enterprise Manager Base Platform version 13.5 or 24.1, specifically the Agent Next Gen component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, elevated privileges, or special configuration settings are required - any unauthenticated attacker who can reach the Agent Next Gen HTTPS endpoint can attempt exploitation. The primary real-world limiting factor is network segmentation: OEM is typically deployed in internal enterprise management networks not directly reachable from the internet, restricting exploitability to internal network actors, VPN users, or attackers with prior lateral movement capability. Impact is bounded to read access of a subset of platform data - no code execution, configuration changes, or availability impact is possible through this vulnerability alone.

The CVSS 3.1 Medium score of 5.3 reflects limited but real-world meaningful risk. The vector AV:N/AC:L/PR:N/UI:N indicates trivially exploitable network access with zero prerequisites, which lowers the exploitation barrier to any network-reachable attacker. However, the scope is unchanged (S:U) and impact is strictly bounded to low confidentiality (C:L, I:N, A:N), meaning no data modification, service disruption, or privilege escalation is possible through this flaw alone. No EPSS data was provided in the input, and absence from CISA KEV means active exploitation has not been confirmed by US government threat intelligence. The 'Authentication Bypass' classification is the most concerning signal: it implies a structural access control gap rather than an incidental data leak, potentially enabling attackers to enumerate managed targets, configuration data, or monitoring metadata. In typical enterprise deployments, OEM is network-restricted to internal management segments, which meaningfully limits the exposed attack surface to internal actors, VPN users, or attackers with prior network foothold. Real-world priority should be elevated above raw CVSS for environments where OEM manages sensitive Oracle database infrastructure.

An unauthenticated attacker with HTTPS access to the internal OEM infrastructure - whether an insider, a VPN-connected user, or a threat actor who has already gained network presence - sends a crafted HTTPS request directly to an Agent Next Gen endpoint, bypassing authentication controls. The attacker receives a subset of OEM platform data in response, potentially including information about monitored targets, agent configuration, or health metrics. This reconnaissance data could then be leveraged to identify high-value Oracle database targets for follow-on attacks. No public exploit code has been identified at time of analysis.