Oracle Enterprise Command Center CVE-2026-46902

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Enterprise Command Center Framework reachable over HTTPS, per AV:N/AC:L/PR:N/UI:N. The only meaningful limiters are that the target must be running ECC V15 or V16 specifically (other EBS components are out of scope of this CVE) and that the ECC HTTPS listener must be network-reachable from the attacker; deployments with ECC isolated behind VPN or internal-only network segments raise the bar to first obtaining internal network position.

Signals strongly align around high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N marks it as remote, low-complexity, and unauthenticated with HIGH impact on all three CIA pillars, and the description explicitly calls it 'easily exploitable' with 'takeover' as the outcome. EPSS, CISA KEV listing, and SSVC decision metadata were not supplied with this report, so the probabilistic exploitation likelihood is unknown - however, ECC is internet-exposed in many EBS deployments, and Oracle CPU-disclosed bugs in EBS have historically attracted scanning within weeks of disclosure. No public exploit identified at time of analysis, but absence of POC data should not be read as low risk given how thin the prerequisite chain is.

An attacker who can reach the ECC HTTPS interface - directly on the internet or pivoting from a compromised internal host - sends a crafted request to the Core component and, without supplying credentials, takes over the ECC instance, gaining the ability to read, alter, or destroy any data ECC can access within the EBS environment. Because attack complexity is low and no user interaction is needed, mass-scanning campaigns against Oracle EBS deployments are a realistic delivery method even though no public exploit identified at time of analysis.