What is the CVSS score of CVE-2026-46899?

CVE-2026-46899 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-46899?

Oracle Enterprise Command Center Framework V15 and V16 contain a critical vulnerability allowing unauthorized read and modification of sensitive business data across Oracle E-Business Suite systems.

How to fix or mitigate CVE-2026-46899?

24 hours: Complete asset inventory of all production Oracle E-Business Suite instances running Enterprise Command Center Framework V15 or V16. 7 days: Implement network-layer access controls restricting HTTP connections to the Command Center Framework to trusted administrative networks only; review and tighten role-based permissions for all standard user accounts. 30 days: Establish vendor communication channel to monitor patch release status; evaluate upgrade path to patched Oracle EBS versions; assess feasibility of compensating controls as interim solution.

Oracle E-Business Suite CVE-2026-46899

EUVD-2026-37391 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Enterprise Command Center Framework Oracle Corporation

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

HTTP-reachable ECC endpoint (AV:N/AC:L), low-privileged EBS account required (PR:L), no user interaction, and a cross-module authorization break drives S:C with C:H/I:H and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:21 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Command Center Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-component compromise in Oracle Enterprise Command Center Framework V15 and V16 allows a low-privileged remote attacker to read and tamper with critical data across adjacent Oracle E-Business Suite components via HTTP. The scope-changed CVSS 3.1 score of 9.6 reflects high confidentiality and integrity impact reaching beyond the vulnerable component, though no public exploit identified at time of analysis. Oracle disclosed the issue in the June 2026 Critical Patch Update.

Technical ContextAI

Oracle Enterprise Command Center Framework (ECC) is a visualization and discovery layer bundled with Oracle E-Business Suite that exposes operational data through web-based dashboards backed by an Endeca-derived data store and Java/Oracle middleware. The Core component handles request routing, session context, and inter-module data access, which is why a flaw here produces a CVSS scope change - actions originating in ECC affect the authorization boundary of other E-Business Suite modules. No CWE was assigned by the reporter, but the combination of HTTP attack vector, low privileges, scope change, and C:H/I:H impacts is consistent with an authorization or access-control failure (CWE-285/CWE-863 class) rather than a memory-corruption bug, aligning with the 'Authentication Bypass' tag supplied with the report.

RemediationAI

Apply the Oracle June 2026 Critical Patch Update fixes for Enterprise Command Center Framework V15 and V16 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle's CPU bundle is the only vendor-released patch path and exact patch numbers are listed in that advisory. Until patches are deployed, restrict network reachability of the ECC dashboards to trusted internal segments via reverse-proxy ACLs or WAF rules, and tighten EBS responsibility/role assignments so that low-privileged accounts cannot reach ECC endpoints - note that ACL restrictions will block legitimate users on untrusted networks, and tightening responsibilities may break dashboards for analytics users until they are re-provisioned. Rotate EBS application user credentials with weak or shared passwords, since the attack requires only PR:L.