Oracle E-Business Suite CVE-2026-46899

Requires HTTP network reachability to an Oracle E-Business Suite deployment running Enterprise Command Center Framework V15 or V16 with the Core component enabled, plus a valid low-privileged EBS application account (PR:L) - no end-user interaction or admin role is needed. Exploitation is limited to environments that actually expose ECC dashboards to the attacker's network position; pure backend EBS installations without ECC, or deployments where ECC is reachable only from a hardened bastion, materially reduce real-world exposure. The 'Authentication Bypass' tag suggests the privileged account need not belong to the targeted module, but Oracle's advisory does not enumerate which specific ECC endpoints carry the flaw.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity attack requiring only a basic authenticated session, with cross-component impact - a realistic profile for an internet- or intranet-exposed EBS deployment where any application user could escalate reach across modules. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so quantified exploitation probability is unknown; however, Oracle EBS CPU vulnerabilities historically attract reverse-engineering once patches ship, and the scope-change semantics make this attractive to attackers already inside an EBS tenant. The vendor advisory does not enumerate the underlying CWE, so the precise primitive (authorization bypass vs. injection-driven data access) is inferred from the impact pattern and the 'Authentication Bypass' tag rather than confirmed.

An attacker who has obtained or been issued a low-privileged Oracle E-Business Suite account (for example, a self-service user or a compromised internal employee credential) sends crafted HTTP requests to Enterprise Command Center Framework endpoints and abuses the Core component to read or modify data belonging to other EBS modules outside their normal authorization scope. Because the scope changes, the attacker can reach financial, HR, or procurement data they were never granted access to, and can both exfiltrate and tamper with it. No public exploit identified at time of analysis, but the low attack complexity makes weaponization straightforward once the patch is diffed.