This vulnerability exists in the Enterprise Config Management component of Oracle Enterprise Manager Base Platform, specifically affecting versions 13.5 and 24.1. It allows an attacker with low privileges and network access over HTTPS to compromise the platform, leading to full system takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes many patches across Oracle products, but it does not explicitly state a patch or fix for this specific vulnerability. Customers are urged to apply available patches promptly, but patch status for this vulnerability is not explicitly confirmed.

Successful exploitation can lead to complete compromise of Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the platform, potentially impacting all managed systems and data within the environment.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities. However, the advisory does not explicitly confirm a patch or fix for CVE-2026-46992 in the affected versions 13.5 and 24.1. Therefore, patch status is not yet confirmed—users should monitor the Oracle advisory for updates and apply any relevant patches as soon as they become available. No vendor guidance indicates that no action is required or that the vulnerability is already mitigated.