What is the CVSS score of CVE-2026-60577?

CVE-2026-60577 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Enterprise Command Center Framework are affected by CVE-2026-60577?

Oracle Enterprise Command Center Framework V16 within Oracle E-Business Suite contains a security flaw allowing authenticated network users to access sensitive business data and make unauthorized…

How to fix or mitigate CVE-2026-60577?

Within 24 hours, conduct a complete inventory of all Oracle E-Business Suite instances running Enterprise Command Center Framework V16 and map network exposure to identify systems accessible from untrusted networks. Within 7 days, implement network segmentation restricting Framework access to authorized business users only, enforce multi-factor authentication on all administrative accounts, and enable detailed audit logging of Framework data access and modification events. Within 30 days, establish continuous monitoring of Oracle's Critical Patch Update releases, develop and test a deployment plan to apply patches immediately upon vendor release, and engage Oracle support to confirm affected versions and request interim workaround guidance.

Oracle Enterprise Command Center Framework CVE-2026-60577

EUVD-2026-46939 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3v2w-4r23-226g

Authentication Bypass Oracle Enterprise Command Center Framework

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP reach with low-privilege account and no user interaction gives AV:N/AC:L/PR:L/UI:N; high data exposure (C:H) with limited writes (I:L) and no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:33 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Information disclosure and partial data tampering in Oracle Enterprise Command Center Framework V16 (a component of Oracle E-Business Suite) allows a low-privileged, network-authenticated attacker to reach critical data and make limited unauthorized modifications over HTTP. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 7.1 with high confidentiality impact and is described by Oracle as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Enterprise Command Center Framework (ECC) is a search-and-analytics UI layer embedded in Oracle E-Business Suite (EBS), delivering faceted, in-memory dashboards over EBS operational data across modules such as Order Management, Procurement, and Inventory. The affected 'Core' component sits in the application/servlet tier and is exposed over HTTP within the EBS deployment. CWE is not assigned by Oracle (N/A), but the supplied 'Authentication Bypass' tag combined with the CVSS profile (PR:L, C:H, I:L) points to a broken access-control / authorization weakness (CWE-284/CWE-863 class) that lets an authenticated user of one privilege level read data and perform limited writes beyond their authorization boundary, rather than a memory-safety or injection defect.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update, which is the authoritative source for the patched ECC Framework V16 bundle - see https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; no standalone fix version was published in this input, so consult the CPU patch matrix for the exact ECC/EBS patch number for your release). Because exploitation only needs a low-privileged network account, prioritize patching internet-facing or broadly-accessible EBS instances first. Until the CPU is applied, reduce exposure by restricting network reachability of the ECC Framework endpoints to trusted internal segments or VPN, tightening EBS role/responsibility assignments so that low-privilege accounts cannot reach ECC dashboards, and increasing monitoring of ECC HTTP access logs for anomalous data-retrieval patterns; note these controls limit legitimate ECC analytics use and do not remediate the underlying authorization flaw.