What is the CVSS score of CVE-2026-46896?

CVE-2026-46896 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Enterprise Command Center Framework are affected by CVE-2026-46896?

Oracle Enterprise Command Center Framework (ECC) versions 15 and 16 within E-Business Suite contain a CVSS 9.1 critical privilege-escalation vulnerability enabling authenticated high-privileged users…

How to fix or mitigate CVE-2026-46896?

Within 24 hours: Identify all Oracle E-Business Suite deployments running ECC V15 or V16; enumerate all user accounts with administrative access to ECC consoles. Within 7 days: Restrict ECC administrative access via role-based controls to essential IT personnel only; implement comprehensive audit logging and real-time alerting for privileged user activities (login, configuration changes, cross-system access); configure network-level controls to restrict ECC communications with other integrated systems. Within 30 days: Monitor Oracle's Critical Patch Update releases for CVE-2026-46896 availability; upon release, establish patch-testing and deployment plan for all affected systems; conduct full privileged-access review across all ECC V15/V16 instances.

Oracle Enterprise Command Center Framework CVE-2026-46896

EUVD-2026-37388 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Enterprise Command Center Framework Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network HTTP reachability with low complexity and no user interaction, but requires a high-privileged EBS account (PR:H); scope change and full CIA loss reflect cross-product impact within EBS.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:23 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privileged takeover of Oracle Enterprise Command Center Framework (ECC) versions V15 and V16, a component of Oracle E-Business Suite, allows a high-privileged authenticated attacker with HTTP network access to fully compromise the ECC component and, through a scope change, significantly impact additional integrated products. Oracle's June 2026 Critical Patch Update advisory rates this CVSS 9.1 (C:H/I:H/A:H with S:C), and no public exploit identified at time of analysis. The combined high privilege requirement and scope change make this a real lateral-movement risk inside ERP deployments rather than a perimeter RCE.

Technical ContextAI

Oracle Enterprise Command Center Framework is a visual analytics and information-discovery layer bundled with Oracle E-Business Suite that provides faceted search dashboards ("Command Centers") over EBS operational data. The affected component is identified as "Core", which underpins ECC's request handling, dataset configuration, and integration with the EBS technology stack. No CWE has been assigned, but the CVSS profile (network HTTP attack vector, low complexity, high privileges, scope change, full CIA loss) is consistent with a server-side authorization or injection flaw in an administrative ECC endpoint that lets a privileged user pivot beyond ECC's own trust boundary into other EBS components running on the same middle tier. The CPE cpe:2.3:a:oracle_corporation:oracle_enterprise_command_center_framework:*:*:*:*:*:*:*:* covers all sub-versions of V15 and V16 per the ENISA EUVD-2026-37388 listing.

RemediationAI

Apply the patches from Oracle's June 2026 Critical Patch Update for Oracle E-Business Suite (https://www.oracle.com/security-alerts/cspujun2026.html), which is the only vendor-released remediation identified for ECC V15 and V16; an exact post-patch ECC build string is not enumerated in the input, so administrators should consult the CPU patch matrix for their EBS release to identify the specific ECC bundle patch. Until the CPU is applied, compensating controls include tightly restricting which EBS responsibilities and roles grant high-privilege access to ECC administration and dataset configuration endpoints, placing the EBS middle tier behind a reverse proxy or WAF that rate-limits and logs HTTP requests to /OA_HTML/ ECC paths, and enabling EBS audit/sign-on logging to detect privilege misuse - recognizing that revoking ECC admin access from legitimate analysts will disrupt dashboard authoring workflows and that proxy-level filtering cannot reliably distinguish malicious from benign authenticated requests.