CVE-2026-46872 is a vulnerability in the Install component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows a high privileged attacker with network access over HTTPS to compromise the platform, with a scope change potentially affecting additional Oracle products. The vulnerability enables unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and the ability to cause hangs or repeated crashes resulting in denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and impacts on confidentiality (low), integrity (high), and availability (high). Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly recommends applying the update promptly. No specific patch version or fix details for this CVE were provided in the advisory content, but the update covers affected versions 13.5 and 24.1. Mitigation options before patching include blocking network protocols required by the attack and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Enterprise Manager Base Platform. It also allows unauthorized read access to a subset of accessible data and can cause denial of service through hangs or repeated crashes. The vulnerability affects confidentiality, integrity, and availability, with a CVSS 3.1 base score of 9.0 indicating critical impact. The scope change means that additional Oracle products beyond the base platform may be significantly impacted by attacks exploiting this vulnerability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. The vendor advisory does not provide a specific patch version for this CVE but includes it in the comprehensive update covering affected versions 13.5 and 24.1. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these measures may affect application functionality. Customers should follow Oracle’s official advisory and patch documentation for detailed instructions.