CVE-2026-46868 affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 in the Extensibility Framework component. The vulnerability allows a high privileged attacker with network access via HTTPS to compromise the platform, potentially resulting in full system takeover. It has a CVSS 3.1 score of 7.2 with high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across various products. The vendor strongly recommends applying these patches without delay. Workarounds include blocking relevant network protocols and removing unnecessary privileges from users, though these may affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access via HTTPS to take over the platform.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these security patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these measures may impact application functionality. Patch status is confirmed by the vendor advisory. No indication that the vulnerability is already mitigated or requires no action.