Skip to main content

Oracle E-Business Suite CVE-2026-46899

| EUVDEUVD-2026-37391 CRITICAL
Improper Access Control (CWE-284)
2026-06-16 oracle
Authentication Bypass Oracle Oracle Enterprise Command Center Framework
9.6
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
9.6 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
vuln.today AI
9.6 CRITICAL

HTTP-reachable ECC endpoint (AV:N/AC:L), low-privileged EBS account required (PR:L), no user interaction, and a cross-module authorization break drives S:C with C:H/I:H and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
Analysis Generated
Jun 16, 2026 - 22:21 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Command Center Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-component compromise in Oracle Enterprise Command Center Framework V15 and V16 allows a low-privileged remote attacker to read and tamper with critical data across adjacent Oracle E-Business Suite components via HTTP. The scope-changed CVSS 3.1 score of 9.6 reflects high confidentiality and integrity impact reaching beyond the vulnerable component, though no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exposed EBS ECC endpoint
Delivery
Authenticate with low-privileged EBS account
Exploit
Send crafted HTTP request to Core component
Execution
Bypass cross-module authorization (scope change)
Persist
Read or modify adjacent EBS data
Impact
Exfiltrate financial or HR records
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires HTTP network reachability to an Oracle E-Business Suite deployment running Enterprise Command Center Framework V15 or V16 with the Core component enabled, plus a valid low-privileged EBS application account (PR:L) - no end-user interaction or admin role is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity attack requiring only a basic authenticated session, with cross-component impact - a realistic profile for an internet- or intranet-exposed EBS deployment where any application user could escalate reach across modules. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained or been issued a low-privileged Oracle E-Business Suite account (for example, a self-service user or a compromised internal employee credential) sends crafted HTTP requests to Enterprise Command Center Framework endpoints and abuses the Core component to read or modify data belonging to other EBS modules outside their normal authorization scope. Because the scope changes, the attacker can reach financial, HR, or procurement data they were never granted access to, and can both exfiltrate and tamper with it. …
Remediation Apply the Oracle June 2026 Critical Patch Update fixes for Enterprise Command Center Framework V15 and V16 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle's CPU bundle is the only vendor-released patch path and exact patch numbers are listed in that advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Complete asset inventory of all production Oracle E-Business Suite instances running Enterprise Command Center Framework V15 or V16. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Oracle Enterprise Command Center Framework

View all
CVE-2026-46900 CRITICAL
9.9 Jun 16

Privileged takeover of Oracle Enterprise Command Center Framework V15 and V16 (a component of Oracle E-Business Suite) a
CVE-2026-46895 CRITICAL
9.9 Jun 16

Privilege escalation and full takeover of Oracle Enterprise Command Center Framework (versions V15 and V16) is achievabl
CVE-2026-46901 CRITICAL
9.9 Jun 16

Scope-changing compromise in Oracle Enterprise Command Center Framework V15 and V16 (a component of Oracle E-Business Su
CVE-2026-46897 CRITICAL
9.9 Jun 16

Privileged data manipulation and disclosure in Oracle Enterprise Command Center Framework V15 and V16 allows a low-privi
CVE-2026-46902 CRITICAL
9.8 Jun 16

Remote unauthenticated takeover of Oracle Enterprise Command Center Framework (versions V15 and V16), a component of Ora
CVE-2026-46896 CRITICAL
9.1 Jun 16

Privileged takeover of Oracle Enterprise Command Center Framework (ECC) versions V15 and V16, a component of Oracle E-Bu
CVE-2026-46898 HIGH
8.1 Jun 16

High-impact confidentiality and integrity compromise in Oracle Enterprise Command Center Framework V15 and V16 (a compon

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-46899 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy