CVE-2026-46855 is a vulnerability in the Metadata Plugin component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It permits a low privileged attacker with network access over HTTPS to compromise the platform, resulting in complete takeover. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The scope of impact extends beyond the base platform to other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability and strongly urges customers to apply patches promptly to mitigate exploitation risks.

Successful exploitation of CVE-2026-46855 can lead to full compromise of Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means additional Oracle products may also be impacted. This can result in unauthorized access, data breaches, and disruption of services managed by the platform.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update that addresses this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or package access from users. Oracle advises customers to remain on actively supported versions and to apply security patches without delay. Patch status is confirmed by the vendor advisory indicating patches are available in the June 2026 Critical Security Patch Update.