What is the CVSS score of CVE-2026-60578?

CVE-2026-60578 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle ECC Framework are affected by CVE-2026-60578?

Oracle E-Business Suite V16's Enterprise Command Center Framework contains a privilege-escalation vulnerability (CVE-2026-60578, CVSS 7.6) allowing high-privileged users or compromised administrator…

How to fix or mitigate CVE-2026-60578?

Within 24 hours, identify and document all high-privileged accounts and administrator credentials with access to Oracle E-Business Suite V16 Enterprise Command Center Framework, including their scope and current activity patterns. Within 7 days, restrict framework administrative access to only essential personnel through role-based access controls, enable comprehensive audit logging for all data reads and modifications within the framework component, and deploy real-time alerting on unusual privileged account access or data exfiltration attempts. Within 30 days, establish a monitoring routine for Oracle's security advisories specific to CVE-2026-60578, prepare and test a patch deployment procedure in a non-production environment, and apply immediately upon vendor patch release.

Oracle ECC Framework CVE-2026-60578

EUVD-2026-46940 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-77p4-rq26-fwwq

Authentication Bypass Oracle Enterprise Command Center Framework

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Network HTTP reach and low complexity, but a high-privilege account is required (PR:H); scope changes (S:C) with high confidentiality and only limited integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:33 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Privilege-abuse compromise in the Oracle Enterprise Command Center Framework (Core component) of Oracle E-Business Suite V16 allows an authenticated high-privileged attacker with HTTP network access to read all framework-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact adjacent Oracle products. Addressed in the July 2026 Oracle Critical Patch Update (CVSS 3.1 base 7.6). No public exploit identified at time of analysis and it is not listed in CISA KEV, so this reflects an unauthenticated-attacker-excluded, insider/compromised-account risk rather than mass exploitation.

Technical ContextAI

Oracle Enterprise Command Center Framework (ECC) is a search-and-analytics UI layer bundled with Oracle E-Business Suite, providing dashboard-style operational command centers over EBS transactional data. The affected 'Core' component is the shared framework runtime that mediates access to ECC-accessible datasets across multiple functional command centers. Oracle publishes no CWE for this issue (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with the S:C (scope change) metric indicates the flaw lets an already-privileged session cross a trust/authorization boundary to reach data or products beyond the framework's own security authority. The CVSS vector's Confidentiality:High with Integrity:Low profile is characteristic of an authorization/access-control weakness in the data-mediation layer rather than a memory-safety or injection bug.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which contains the fix for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact ECC/EBS patch numbers for your version (Patch available per vendor advisory - Oracle CPUs do not expose a simple semantic fix version, so map your V16 baseline to the CPU's listed patch). Until patched, reduce exposure by restricting network access to the ECC/EBS application tier so it is not reachable from untrusted networks (place behind VPN or reverse-proxy allowlists), since the vector is AV:N over HTTP; this may impact legitimate remote users and integrations. Because exploitation requires a high-privileged account (PR:H), tighten privileged-account controls: audit and minimize ECC/EBS administrative and high-privilege responsibilities, enforce MFA on those accounts, and monitor privileged session activity for anomalous ECC data access. These controls limit opportunity but are not a substitute for the CPU patch given the scope-change impact on adjacent Oracle products.