CVE-2026-46864 affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1, specifically the Agent Next Gen component. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via SSH to compromise the platform, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory, which includes patches addressing this and many other vulnerabilities. The advisory emphasizes the importance of applying patches without delay and notes that failure to patch has led to successful exploitation attempts. No specific exploit in the wild is currently known. Mitigation options before patching include blocking network protocols used by the attack and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of CVE-2026-46864 can lead to complete compromise of the Oracle Enterprise Manager Base Platform, impacting confidentiality, integrity, and availability of the system. This means attackers could gain unauthorized access, modify or disrupt data and services, and potentially take full control of the affected platform. Given the network attack vector and low complexity, the vulnerability poses a significant risk if left unpatched.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not need them. However, these mitigations may impact application functionality. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory linked in the report.