Oracle Enterprise Command Center Framework CVE-2026-46901

Requires network reachability to the Oracle E-Business Suite application tier over HTTP/HTTPS and a valid low-privileged EBS account that can invoke the Enterprise Command Center Framework Core component (CVSS PR:L, UI:N). Affected deployments must be running ECC V15 or V16 as part of an EBS installation; environments without ECC enabled, or where ECC endpoints are firewalled from general user populations, are not reachable. No user interaction or special client tooling is needed, but the 'Authentication Bypass' tag suggests the low-privilege requirement may collapse to none in some attack paths - Oracle's CPU notes should be consulted to confirm whether anonymous access is possible.

Real-world risk is high for any internet-exposed or broadly-accessible Oracle EBS deployment running ECC V15/V16. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) indicates trivial network exploitation by any user with low-privilege EBS credentials, and the Scope:Changed flag means blast radius extends to other EBS products - a major escalation signal. No EPSS score, KEV listing, or SSVC decision is provided in the input, so probability-of-exploitation cannot be quantified, and no public exploit identified at time of analysis. The 'Authentication Bypass' tag conflicts with PR:L in the CVSS vector (a true auth bypass would normally be PR:N) - this discrepancy should be verified against Oracle's CPU notes before assuming unauthenticated reachability. Oracle EBS has a long history of post-CPU exploitation by both ransomware and state-aligned actors, so this should be prioritized regardless of current exploitation telemetry.

An attacker who has obtained any low-privilege Oracle E-Business Suite account - for example a self-registered iStore/iRecruitment user or a compromised employee SSO session - sends crafted HTTP requests to the ECC Core endpoints and abuses the flaw to read, alter, or delete data belonging to other EBS modules outside the user's normal authorization. Because Scope is Changed, the attacker can pivot from the ECC component into other EBS subsystems (financials, HR, procurement), enabling fraud, data theft, or sabotage. No public exploit identified at time of analysis, but Oracle CPU bugs are frequently reverse-engineered from patch diffs within weeks of release.