What is the CVSS score of CVE-2026-60580?

CVE-2026-60580 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Enterprise Command Center are affected by CVE-2026-60580?

Oracle Enterprise Command Center Framework V16, a component of Oracle E-Business Suite, is vulnerable to unauthenticated full system compromise by attackers with adjacent network access (CVSS 8.8).

How to fix or mitigate CVE-2026-60580?

Within 24 hours, immediately segment the network to restrict access to affected Oracle Enterprise Command Center Framework V16 instances; apply host-based firewall rules limiting connectivity to trusted administrative networks only. Within 7 days, conduct a complete inventory of all Oracle E-Business Suite deployments with Framework V16; for each instance, implement mandatory VPN access or air-gapped network restrictions, and establish continuous network monitoring to detect adjacent-network reconnaissance. Within 30 days, establish an escalation process with Oracle support to obtain workaround guidance; document business continuity procedures for potential system compromise; prepare a staged patching plan to deploy immediately when a vendor-released patch becomes available.

Enterprise Command Center CVE-2026-60580

EUVD-2026-46942 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-gqxf-fp2c-wv33

Authentication Bypass Oracle Enterprise Command Center Framework

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent-only access (AV:A) with no auth or interaction (PR:N/UI:N) and low complexity yields full unscoped C/I/A takeover, matching an 8.8 base.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:32 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Enterprise Command Center Framework executes to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Enterprise Command Center Framework V16 (a component of Oracle E-Business Suite) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, and the vector's adjacent attack surface (AV:A) plus low complexity make it trivial to exploit once network adjacency is achieved. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.

Technical ContextAI

Oracle Enterprise Command Center (ECC) Framework is an analytics/visualization layer bundled with Oracle E-Business Suite (the 'Core' component), used to build interactive dashboards over EBS data. Because the affected attack vector is Adjacent (AV:A), the flaw is exploited over the local IP subnet or broadcast/link-layer segment attached to the host running ECC - not routed across the internet. The CWE is not assigned (N/A), so the precise root-cause class is unconfirmed; the vendor's 'Information Disclosure' tag combined with full C/I/A impact suggests a network-service-level weakness that escalates from data exposure to complete compromise of the ECC Framework rather than a single narrow bug.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this issue - review and deploy the ECC Framework patch referenced at https://www.oracle.com/security-alerts/cpujul2026.html (no discrete fix version string was provided in the input, so identify the exact patch/bundle for your ECC V16 install from the CPU matrix). Patch available per vendor advisory; a specific patched build number was not supplied here. Because the attack vector is Adjacent (AV:A), the strongest compensating control until patching is network segmentation: place the ECC/EBS hosts on an isolated VLAN, restrict Layer-2/subnet access to only trusted management systems, and deny arbitrary hosts on the same segment (trade-off: may require firewall/ACL changes and can disrupt legitimate same-subnet integrations). Additionally monitor for anomalous internal connections to the ECC service ports and enforce strict access control on any jump/bastion hosts that share the segment.