This vulnerability in the Oracle Enterprise Manager Base Platform (component: Enterprise Config Management) allows an unauthenticated attacker with network access via HTTP to compromise the platform. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data, as well as partial denial of service. The CVSS 3.1 base score is 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Affected versions explicitly include 13.5 and 24.1. The vendor advisory is a general Critical Patch Update for July 2026 covering many products but does not specifically confirm patch availability or remediation details for this vulnerability.

The vulnerability allows an unauthenticated remote attacker to gain unauthorized read and write access to some data within Oracle Enterprise Manager Base Platform, potentially leading to data compromise and partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for CVE-2026-46990. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed, monitor Oracle's advisories for updates. No vendor-stated 'no action required' or 'already mitigated' guidance is present.