Oracle Enterprise Manager CVE-2026-46986

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no special conditions beyond network-level HTTPS access to the Agent Next Gen component are required. Exploitation requires only that the attacker can reach the affected system's HTTPS port - no authentication, no user interaction, and no non-default configuration is needed. The specific limiting factors are: (1) only Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 are confirmed affected; (2) exploitation is bounded to read access on a subset of platform data with no confirmed integrity or availability impact; (3) organizations that have deployed OEM Agent Next Gen endpoints within isolated management network segments, behind firewall rules restricting access to OMS servers only, have materially reduced exposure despite the network-vector classification.

The CVSS 3.1 base score of 5.3 (Medium) reflects a low-confidentiality-impact outcome, but the surrounding signal profile elevates real-world priority above what the score alone implies. The vector AV:N/AC:L/PR:N/UI:N confirms this is trivially exploitable from any network location with no prerequisites - a combination that characterizes the most easily mass-exploitable vulnerability class. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be formally quantified. There is no CISA KEV listing and no confirmed POC, indicating no confirmed active exploitation at time of analysis. However, Oracle Enterprise Manager manages sensitive enterprise infrastructure including databases and middleware; even read-only access (C:L) to agent-exposed data could leak monitored target details, hostnames, configuration metadata, or partial credentials context useful for lateral movement or privilege escalation planning. The 'Authentication Bypass' tag suggests the access control failure may be structurally broader than the C:L impact rating captures. Organizations exposing OEM HTTPS endpoints beyond isolated management networks should treat this as higher practical priority than its numeric score suggests.

A remote attacker with network connectivity to an Oracle Enterprise Manager deployment sends unauthenticated HTTPS requests to the Agent Next Gen component endpoint, exploiting the authentication bypass to enumerate a subset of platform-accessible data such as managed target metadata, agent configuration, or monitoring artifacts. No public exploit code is confirmed, but the zero-prerequisite attack profile (no credentials, no user interaction, low complexity) means a motivated attacker could develop functional exploit code against the exposed API with minimal reverse engineering effort. Environments where OEM HTTPS interfaces are reachable from untrusted networks are at highest immediate risk.