CVE-2026-46856 is a vulnerability in the Metadata Plugin component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is exploitable remotely over HTTP by unauthenticated attackers but requires user interaction from a third party. The vulnerability has a critical CVSS 3.1 score of 9.6 with network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. Successful exploitation can result in complete takeover of the Oracle Enterprise Manager Base Platform and potentially affect other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches as soon as possible. No explicit patch or fix version is stated in the advisory content provided. Oracle also suggests mitigating risk by blocking network protocols involved in the attack and restricting privileges where feasible until patches are applied.

The vulnerability allows unauthenticated remote attackers to compromise Oracle Enterprise Manager Base Platform, potentially leading to full system takeover. It affects confidentiality, integrity, and availability at a high level. The attack requires human interaction from a user other than the attacker, and successful exploitation may impact additional Oracle products beyond the base platform, indicating a scope change. This represents a critical security risk for affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation (e.g., HTTP access to the affected component) and by removing unnecessary privileges or access to relevant packages from users who do not require them. These mitigations may impact application functionality, so they should be tested carefully. Patch status is not explicitly confirmed in the advisory content; customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.