CVE-2026-46832 is a vulnerability in the Discovery Framework component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows an attacker with low privileges and network access via HTTPS to compromise the platform, potentially leading to full system takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 score of 9.9 and has a scope change that may impact additional Oracle products. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly detailed a specific patch version in the provided content. Oracle strongly advises applying the Critical Security Patch Update to mitigate this risk. Temporary mitigations include blocking attack-related network protocols and restricting privileges for users who do not require them.

Successful exploitation of CVE-2026-46832 can lead to complete compromise of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability. The vulnerability also has the potential to impact additional Oracle products beyond the base platform due to scope change. This could result in unauthorized access, data breaches, and disruption of services managed by the platform.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users who do not need them. These mitigations may impact application functionality and should be applied cautiously. Patch status is not explicitly confirmed in the advisory content; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.