CVE-2026-46857 is a vulnerability in the Oracle Enterprise Manager Base Platform component (Oracle Management Service) affecting versions 13.5 and 24.1. It is easily exploitable by unauthenticated attackers over HTTP, allowing full compromise of the platform. The vulnerability is scored 9.8 (CVSS 3.1) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 fixes but does not explicitly state patch availability or remediation level for this specific CVE. Oracle urges customers to apply the Critical Security Patch Update without delay to address this and other vulnerabilities. Workarounds include blocking network protocols or removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation of CVE-2026-46857 allows an unauthenticated attacker with network access via HTTP to take over the Oracle Enterprise Manager Base Platform, compromising confidentiality, integrity, and availability of the system. This represents a critical security risk for affected versions 13.5 and 24.1.

Oracle's June 2026 Critical Security Patch Update advisory strongly recommends applying the provided security patches as soon as possible to remediate this vulnerability. Although the advisory does not explicitly confirm a patch specifically for CVE-2026-46857, it is included in the update containing 245 security fixes. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, but these measures may impact application functionality. Customers should monitor Oracle's official advisory for updated patch and remediation information.