CVE-2026-46991 is a vulnerability in the Oracle Enterprise Manager Base Platform's Enterprise Config Management component affecting versions 13.5 and 24.1. It allows an attacker with low privileges and logon access to the underlying infrastructure to perform unauthorized update, insert, delete, and read operations on some data accessible by the platform. The CVSS 3.1 vector indicates local attack vector with low attack complexity and low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a fix for this CVE. Customers are urged to apply patches promptly once available.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Enterprise Manager Base Platform. This could lead to data integrity and confidentiality breaches within the affected platform. There is no impact on availability. The attack requires local access with low privileges and no user interaction.

Oracle has not explicitly confirmed a patch or remediation level for CVE-2026-46991 in the provided advisory. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when they become available and remaining on actively supported versions. Until a patch is confirmed, restrict access to the infrastructure hosting Oracle Enterprise Manager Base Platform to trusted users only.