What is the CVSS score of CVE-2026-46900?

CVE-2026-46900 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle ECC Framework are affected by CVE-2026-46900?

A critical vulnerability in Oracle Enterprise Command Center Framework V15 and V16 allows remote attackers to completely compromise these business-critical systems and spread to other Oracle…

How to fix or mitigate CVE-2026-46900?

Within 24 hours: Inventory all Oracle EBS deployments with CCF V15 or V16; restrict access from low-privileged accounts where operationally feasible; enable detailed activity logging. Within 7 days: Apply Oracle June 2026 Critical Patch Update to all affected production and non-production systems. Within 30 days: Validate patch installation across the enterprise; analyze logs for indicators of exploitation; conduct security testing to confirm vulnerability closure.

Oracle ECC Framework CVE-2026-46900

EUVD-2026-37219 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Enterprise Command Center Framework Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTPS-reachable ECC endpoint (AV:N), no special conditions (AC:L), any EBS user credential suffices (PR:L), no interaction (UI:N), and takeover plus impact on other EBS modules justifies S:C with full C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:20 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privileged takeover of Oracle Enterprise Command Center Framework V15 and V16 (a component of Oracle E-Business Suite) allows a low-privileged remote attacker over HTTPS to fully compromise the product and pivot into other E-Business Suite components via a CVSS scope change. Oracle has issued a fix in its June 2026 Critical Patch Update; no public exploit identified at time of analysis and EPSS/KEV signals were not provided.

Technical ContextAI

Oracle Enterprise Command Center Framework (ECC) is a search-and-discovery analytics layer bundled with Oracle E-Business Suite (EBS) that exposes interactive dashboards over HTTPS and integrates with EBS modules such as Financials, Procurement, HCM and Supply Chain. The affected CPE oracle_corporation:oracle_enterprise_command_center_framework covers ECC V15 and V16 only. CWE is unassigned by Oracle (a common practice in CPU advisories), but the CVSS scope-change with full C/I/A impact combined with PR:L is characteristic of an authenticated authorization bypass or injection flaw in a server-side endpoint that executes against shared EBS resources.

RemediationAI

Apply Oracle's June 2026 Critical Patch Update for Oracle E-Business Suite as documented at https://www.oracle.com/security-alerts/cspujun2026.html, installing the ECC Framework patches that supersede V15 and V16 on every EBS environment (production, DR, test) - exact fix-level identifiers are enumerated in the CPU advisory and should be cited from the patch table rather than guessed. Until the CPU is deployed, restrict network reachability of the ECC Framework endpoints to trusted internal segments via WAF or reverse-proxy ACLs, disable ECC dashboards for user roles that do not require them (accepting loss of search/analytics functionality for those users), enforce MFA on all EBS responsibilities to raise the cost of obtaining the low-privilege foothold the bug requires, and increase monitoring of ECC servlet URLs and EBS database audit logs for anomalous cross-module access since the scope change means exploitation can manifest in other EBS components.