This vulnerability exists in the Metadata Plugin component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows an attacker with low privileges and network access over HTTPS to perform unauthorized actions including creation, deletion, or modification of critical or accessible data, and unauthorized reading of some data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for these versions. Oracle urges customers to apply security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Enterprise Manager Base Platform, as well as unauthorized read access to a subset of accessible data. This impacts data confidentiality and integrity but does not affect availability. The vulnerability requires network access via HTTPS and low privileges, making it relatively easy to exploit.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities including CVE-2026-46996. However, the advisory does not explicitly confirm patch availability or remediation level for affected versions 13.5 and 24.1. Organizations should monitor Oracle's official security alerts and apply relevant Critical Patch Updates as soon as they become available. Until patches are applied, restrict network access to Oracle Enterprise Manager Base Platform where possible to reduce exposure.