CVE-2026-46853 is a vulnerability in the Oracle Enterprise Manager Base Platform's Metadata Plugin affecting versions 13.5 and 24.1. It allows an unauthenticated attacker with network access via HTTP to compromise the platform, requiring user interaction from a third party. The vulnerability has a CVSS 3.1 score of 9.6 with critical impacts on confidentiality, integrity, and availability, and a scope change that may affect additional Oracle products. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 patches but does not explicitly confirm a dedicated patch or remediation level for this CVE. Oracle advises customers to apply the Critical Security Patch Update without delay and consider network protocol blocking or privilege restrictions as interim mitigations.

Successful exploitation can lead to full takeover of the Oracle Enterprise Manager Base Platform, compromising confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it can significantly impact additional Oracle products beyond the base platform. This represents a critical risk to affected environments.

Oracle's June 2026 Critical Security Patch Update advisory strongly recommends applying the provided security patches as soon as possible to address this vulnerability and others. Although the advisory does not explicitly confirm a specific patch for CVE-2026-46853, it is included in the update's risk matrix. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary user privileges or access to vulnerable components. These mitigations may impact application functionality. Customers should monitor Oracle's advisory for updated patch availability and instructions.