CVE-2026-46852 affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 in the Metadata Plugin component. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTPS to compromise the platform, resulting in a complete takeover. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 patches but does not explicitly state patch availability or remediation status for this CVE. Oracle strongly urges customers to apply the Critical Security Patch Update without delay to address this and other vulnerabilities.

Successful exploitation of CVE-2026-46852 can lead to full compromise of Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability of the system. The vulnerability allows an attacker with low privileges and network access via HTTPS to escalate control, potentially affecting additional Oracle products due to scope change. The CVSS score of 9.9 reflects critical severity with network attack vector, low attack complexity, and no user interaction required.

Oracle's advisory strongly recommends applying the June 2026 Critical Security Patch Update promptly to remediate this vulnerability. While the advisory does not explicitly confirm patch availability for CVE-2026-46852, the update includes 245 security patches addressing multiple products including Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these measures may impact application functionality. Customers should monitor Oracle's advisory for patch release confirmation and apply updates without delay.