What is the CVSS score of CVE-2026-60581?

CVE-2026-60581 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle ECC Framework are affected by CVE-2026-60581?

Oracle Enterprise Command Center Framework in E-Business Suite V16 is vulnerable to complete system compromise by attackers with network access to the internal segment hosting the server, potentially…

How to fix or mitigate CVE-2026-60581?

Within 24 hours: Identify all Oracle E-Business Suite V16 systems with the Enterprise Command Center Framework deployed and validate existing network access controls restricting the component to authorized internal systems only. Within 7 days: Implement network segmentation and firewall rules to ensure the component is accessible only from trusted internal systems, disable the component if operationally feasible, and increase monitoring for unauthorized access attempts. Within 30 days: Establish a patching plan for Oracle's July 2026 Critical Patch Update and prepare for rapid deployment once released; maintain network-based compensating controls until patch deployment is complete.

Oracle ECC Framework CVE-2026-60581

EUVD-2026-46943 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9rjv-q227-gm4j

Authentication Bypass Oracle Enterprise Command Center Framework

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent-segment reachability gives AV:A, difficult conditions give AC:H, no credentials give PR:N, and stated takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:31 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Enterprise Command Center Framework executes to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Enterprise Command Center Framework (Core component of Oracle E-Business Suite) V16 is possible for an unauthenticated attacker who has adjacent-network access to the physical segment attached to the host, resulting in complete takeover with high confidentiality, integrity, and availability impact. Exploitation is rated difficult (high attack complexity) and requires the attacker to already sit on the same communication segment as the server, so it is not a remotely-reachable internet flaw. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and addressed in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Enterprise Command Center Framework (ECC) is an add-on analytics/dashboard component embedded within Oracle E-Business Suite, providing interactive command-center dashboards over EBS transactional data. This finding lives in the ECC 'Core' component of EBS release V16. Oracle does not publish a specific CWE for this entry (CWE: N/A) and, per its Critical Patch Update convention, discloses only the affected component, impact, and CVSS vector rather than root-cause detail. The CVSS vector's Adjacent attack vector (AV:A) indicates the flaw is reachable at the link/segment layer rather than routed across networks, which typically points to a network-facing service or protocol handler on the ECC host that trusts or mishandles traffic originating from the local broadcast/communication segment.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is patch available per vendor advisory, as Oracle publishes the ECC/EBS patch set through the CPU rather than a standalone tagged version, so no exact fix build number is provided in the source data - consult the CPU patch matrix and My Oracle Support for the specific ECC V16 patch. Because the attack requires adjacency to the host's communication segment, effective compensating controls until patching is complete are network-layer: place the EBS/ECC hosts on a dedicated, tightly segmented VLAN with no untrusted devices, restrict the physical/L2 segment via port security and 802.1x, and monitor for anomalous traffic on that segment - the trade-off is added network administration overhead and possible disruption to legitimate management tooling that shares the segment. Avoid deploying ECC hosts on shared or user-accessible network segments.