Oracle Enterprise Command Center Framework CVE-2026-60577

Exploitation requires network HTTP access to the Oracle Enterprise Command Center Framework Core component in an EBS V16 deployment and a low-privileged authenticated account (CVSS PR:L), with no user interaction. What limits exploitation: the attacker must already possess valid low-privilege EBS credentials and network reachability to the ECC endpoints, so environments that keep EBS/ECC off the public internet and tightly scope user responsibilities are less exposed. Note the input's 'Authentication Bypass' tag conflicts with PR:L - if a genuine unauthenticated bypass path exists, the credential prerequisite would not apply; verify against the Oracle CPU advisory before relying on authentication as a mitigating control.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1) indicates a genuinely reachable, low-complexity, network-based flaw requiring only low privileges and no user interaction - a realistic priority for any EBS estate exposing ECC to a broad user population, since any low-privileged EBS account becomes a stepping stone to critical data. However, key exploitation signals are absent: no EPSS score was provided, there is no POC, and it is not in CISA KEV, so there is no evidence of active or automated exploitation. The 'Authentication Bypass' tag appears to conflict with the PR:L metric (which requires the attacker to already hold some privilege); this should be verified against the Oracle advisory, as a true pre-auth bypass would materially raise the risk above the assigned 7.1. Confidentiality impact is High but integrity is only Low and availability None, so the primary realistic risk is mass data exposure with limited tampering, not full compromise or disruption.

An attacker who holds any low-privileged Oracle E-Business Suite account (or obtains one via phishing or credential reuse) sends crafted HTTP requests to the Enterprise Command Center Framework Core component and retrieves critical business data outside their authorization scope, then performs limited unauthorized inserts, updates, or deletes. Because attack complexity is low and no user interaction is required, the requests can be scripted once the endpoint behavior is understood. No public POC has been identified at time of analysis.