CVE-2026-46865 is a vulnerability in the Extensibility Framework component of Oracle Enterprise Manager Base Platform, affecting versions 13.5 and 24.1. It allows a high privileged attacker with logon access to the infrastructure hosting the platform to compromise it, resulting in potential full takeover. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high impact on confidentiality, integrity, and availability, with a scope change affecting additional Oracle products. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle products. The vendor strongly urges customers to apply these patches without delay. Until patches are applied, risk mitigation may include blocking required network protocols and removing unnecessary privileges from users. The vendor advisory does not specify a direct patch version for this vulnerability but emphasizes the importance of the Critical Security Patch Update.

Successful exploitation of CVE-2026-46865 can lead to complete compromise and takeover of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. Due to scope change, additional Oracle products integrated or dependent on this platform may also be significantly impacted. The vulnerability requires a high privileged attacker with logon access to the infrastructure, which limits the attack vector to insiders or those with elevated access. The high CVSS score (8.2) reflects the critical nature of the impact if exploited.

Oracle has released the June 2026 Critical Security Patch Update which includes fixes addressing CVE-2026-46865 among other vulnerabilities. Customers are strongly advised to apply this Critical Security Patch Update promptly to remediate the vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to packages from users who do not require them. Oracle does not provide a specific patch version for this vulnerability but recommends applying the full Critical Security Patch Update. No indication of 'no action required' or 'already mitigated' is present; therefore, patching is the primary mitigation.