This vulnerability exists in the Metadata Plugin component of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It is easily exploitable remotely without authentication over HTTPS but requires user interaction from a third party. Exploitation can lead to full compromise of the Oracle Enterprise Manager Base Platform, affecting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no explicit vendor remediation level stated in the advisory, and no direct patch link is provided in the input data. The vendor advisory references a Critical Patch Update released in July 2026, which typically includes cumulative patches for such vulnerabilities. Customers are strongly advised to apply the latest Oracle Critical Patch Updates promptly.

An unauthenticated attacker with network access via HTTPS can exploit this vulnerability with user interaction to take over the Oracle Enterprise Manager Base Platform. This results in full compromise impacting confidentiality, integrity, and availability of the platform. The high CVSS score (8.8) reflects the critical nature of the impact.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities including this one. Although no specific patch link for CVE-2026-46998 is provided, customers should promptly apply the latest Oracle Critical Patch Update to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is not explicitly confirmed in the advisory content; therefore, check the Oracle Critical Patch Update July 2026 advisory for current patch availability and installation instructions.