CVE-2026-46866 is a vulnerability in the Oracle Enterprise Manager Base Platform (Agent Next Gen component) affecting versions 13.5 and 24.1. It allows an unauthenticated attacker with network access over HTTPS to cause a hang or repeated crash (complete denial of service) and to perform unauthorized update, insert, or delete operations on some accessible data. The CVSS 3.1 score is 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches. The vendor strongly advises applying these patches without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation allows unauthenticated remote attackers to cause a complete denial of service by hanging or crashing the Oracle Enterprise Manager Base Platform and to perform unauthorized modifications (update, insert, delete) on accessible data. This impacts system availability and data integrity but does not affect confidentiality.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly. Until patches are applied, risk may be reduced by blocking network protocols required for the attack or by removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is confirmed by the vendor advisory. No indication that the vulnerability is already mitigated without patching.