Paper/Archive/CVE-2026-46858

CVE-2026-46858

Oracle Corporation APM - Application Performance Management — Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics).

EPSS 0.4%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 38.9.389 × 207.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise APM - Application Performance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all APM - Application Performance Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of APM - Application Performance Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Affected

ProductAffectedFixed inSource

APM - Application Performance Management13.5–CNA

APM - Application Performance Management24.1–CNA

Scores by source

oracle (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisoryoracle.com/security-alerts/cspujun2026.html