Description
Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise APM - Application Performance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all APM - Application Performance Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of APM - Application Performance Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-06-16
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the Oracle Application Performance Management (APM) product, specifically in the JADM and JVM Diagnostics components. An unauthenticated attacker who can reach the service via HTTP can create, delete, or modify critical data and can also cause the application to repeatedly crash. This leads to high integrity and availability impacts, allowing the attacker to alter or destroy data and disrupt service operations.

Affected Systems

The affected products are Oracle APM 13.5 and 24.1, part of Oracle Enterprise Manager. No other versions are listed as impacted.

Risk and Exploitability

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score of less than 1% indicates that, as of the current data, exploit attempts observed globally are rare, but the low entry barrier and lack of authentication make it highly attractive for attackers. The attack vector is network-based via HTTP, and the vulnerability is not currently listed in the CISA KEV catalog.

Generated by OpenCVE AI on June 17, 2026 at 18:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle APM patch for versions 13.5 and 24.1, which fixes the JADM/JVM Diagnostics flaw.
  • Disable or restrict anonymous access to the JADM interface and other diagnostic HTTP endpoints.
  • Configure firewall rules to allow APM traffic only from trusted management networks.

Generated by OpenCVE AI on June 17, 2026 at 18:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 16 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise APM - Application Performance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all APM - Application Performance Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of APM - Application Performance Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle apm - Application Performance Management
CPEs cpe:2.3:a:oracle:apm_-_application_performance_management:13.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:apm_-_application_performance_management:24.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle apm - Application Performance Management
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Apm - Application Performance Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-06-17T14:40:12.421Z

Reserved: 2026-05-18T15:55:10.307Z

Link: CVE-2026-46858

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-17T03:15:02Z

Weaknesses

No weakness.