Oracle Enterprise Command Center Framework CVE-2026-46895

Attacker must (a) reach the Oracle E-Business Suite application tier over HTTP, and (b) hold a valid low-privileged EBS account that grants any access to the Enterprise Command Center Framework (PR:L in the CVSS vector and the description's 'low privileged attacker' wording). No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to deployments running ECC V15 or V16 as part of EBS - installations without the ECC framework enabled are not in scope; deployments that keep EBS off the public internet substantially narrow the attacker population to insiders or VPN-borne actors.

All available signals point to a genuine high-priority issue rather than an inflated CVSS. The vector AV:N/AC:L/PR:L/UI:N means a network-reachable attacker with only a low-privileged EBS account, no user interaction, and low attack complexity can succeed; the S:C scope change combined with full C/I/A impact justifies the 9.9 base score and indicates blast radius beyond ECC itself. EPSS and SSVC values are not provided in the input, so probabilistic exploitation likelihood cannot be quoted; CISA KEV status is not flagged, so this is not yet confirmed actively exploited. Oracle EBS is internet-exposed in many enterprises and is a recurring target for opportunistic attackers, so the practical risk for organizations that expose EBS externally is high even absent a public PoC. Note that the description states 'low privileged attacker' explicitly, which is consistent with the PR:L metric - no conflict between vector and prose.

An attacker who has obtained or self-registered a low-privileged Oracle E-Business Suite account (for example, a vendor- or partner-portal user) sends crafted HTTP requests to the ECC framework endpoints on the EBS application tier. Because the vulnerability allows a scope change with high impact on confidentiality, integrity, and availability, the attacker leverages it to take over the ECC service and pivot into adjacent EBS modules sharing the same tier, accessing financial or HR data and altering records. No public exploit identified at time of analysis, so the scenario assumes adversary-developed tooling derived from the Oracle advisory.