CVE-2026-46858 is a critical vulnerability in Oracle Enterprise Manager's APM - Application Performance Management component (JADM, JVM Diagnostics) affecting versions 13.5 and 24.1. It allows an unauthenticated attacker with network access over HTTP to compromise the application, resulting in unauthorized modification of critical data and the ability to cause a hang or repeated crash leading to denial of service. The vulnerability is scored 9.1 on the CVSS 3.1 scale with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on integrity and availability. Oracle has acknowledged this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products. However, the advisory does not explicitly confirm the availability of a patch for this specific vulnerability. Oracle advises customers to apply the Critical Security Patch Update without delay and consider network-level mitigations and privilege restrictions as interim measures.

Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within the APM - Application Performance Management product. Additionally, it can cause the application to hang or crash repeatedly, resulting in a complete denial of service. The vulnerability affects the integrity and availability of the system but does not impact confidentiality. The CVSS 3.1 base score of 9.1 reflects the critical nature of these impacts.

Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 addressed issues and strongly recommends applying the update as soon as possible. Although the advisory does not explicitly confirm a patch specifically for CVE-2026-46858, applying the Critical Security Patch Update is the primary recommended mitigation. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or package access from users. These mitigations may affect application functionality and should be applied cautiously. Customers should monitor Oracle's advisory for updated patch availability and instructions.