CVE-2026-46858

Unauthenticated Access Control Flaw in Oracle APM JADM and JVM Diagnostics Enabling Data Modification and DoS

Published Jun 16, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise APM - Application Performance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all APM - Application Performance Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of APM - Application Performance Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Analysis

Technical impact

The vulnerability exists in the Oracle Application Performance Management (APM) product, specifically in the JADM and JVM Diagnostics components. An unauthenticated attacker who can reach the service via HTTP can create, delete, or modify critical data and can also cause the application to repeatedly crash. This leads to high integrity and availability impacts, allowing the attacker to alter or destroy data and disrupt service operations.

Affected Systems

The affected products are Oracle APM 13.5 and 24.1, part of Oracle Enterprise Manager. No other versions are listed as impacted.

Risk and Exploitability

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score of less than 1% indicates that, as of the current data, exploit attempts observed globally are rare, but the low entry barrier and lack of authentication make it highly attractive for attackers. The attack vector is network-based via HTTP, and the vulnerability is not currently listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

APM - Application Performance Management

affected

Version	Status	Constraints
`13.5`	affected	—
`24.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oracle:application_performance_management:13.5:::::::*
	cpe:2.3:a:oracle:application_performance_management:24.1:::::::*

No data.

Vendor Product Versions

Oracle

Apm - Application Performance Management

Version	Status	Scheme	Platform
`13.5`	affected	generic	—
`24.1`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Oracle APM patch for versions 13.5 and 24.1, which fixes the JADM/JVM Diagnostics flaw.
Disable or restrict anonymous access to the JADM interface and other diagnostic HTTP endpoints.
Configure firewall rules to allow APM traffic only from trusted management networks.

Generated by OpenCVE AI on June 18, 2026 at 23:44 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.447% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 19, 2026 12:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated Access Control Flaw in Oracle APM JADM and JVM Diagnostics Enabling Data Modification and DoS

Jun 18, 2026 10:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Remote Unauthenticated Data Modification and Denial of Service in Oracle APM via HTTP
Weaknesses	CWE-20 CWE-79

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Remote Unauthenticated Data Modification and Denial of Service in Oracle APM via HTTP
Weaknesses		CWE-20 CWE-284 CWE-79
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise APM - Application Performance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all APM - Application Performance Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of APM - Application Performance Management. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
First Time appeared		Oracle Oracle apm - Application Performance Management
CPEs		cpe:2.3:a:oracle:apm_-_application_performance_management:13.5:::::::* cpe:2.3:a:oracle:apm_-_application_performance_management:24.1:::::::*
Vendors & Products		Oracle Oracle apm - Application Performance Management
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}`