This vulnerability in Oracle Enterprise Manager Base Platform (Agent Next Gen component) affects versions 13.5 and 24.1. It allows an unauthenticated attacker with network access over HTTPS to compromise the platform, resulting in unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions this vulnerability but does not explicitly confirm a patch or remediation level for it. Oracle strongly recommends applying security patches from their Critical Patch Updates to mitigate vulnerabilities.

Successful exploitation results in unauthorized read access to some data within Oracle Enterprise Manager Base Platform. There is no impact on data integrity or availability. The vulnerability is exploitable remotely without authentication, increasing risk exposure. However, the confidentiality impact is limited (partial data disclosure). No known exploits in the wild have been reported at this time.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation level for CVE-2026-46985. Customers are strongly advised to apply the latest Critical Patch Update from Oracle promptly to address this and other vulnerabilities. Until an official patch or workaround is confirmed, monitoring Oracle advisories for updates is recommended. No vendor advisory states that no action is required or that the issue is already mitigated.