CVE-2026-46867 is a vulnerability in the Extensibility Framework component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows a high privileged attacker with network access over HTTPS to compromise the platform, potentially leading to full system takeover. The vulnerability is rated with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating network exploitable with low attack complexity but requiring high privileges and no user interaction. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle products. The vendor advisory emphasizes the importance of applying these patches promptly and recommends reducing risk by blocking required network protocols or removing unnecessary privileges until patches are applied.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. An attacker with high privileges and network access via HTTPS can take over the platform, potentially allowing unauthorized control and disruption of services.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to mitigate the risk. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle recommends remaining on actively supported versions and promptly applying security updates.