Oracle Enterprise Command Center Framework CVE-2026-60582

Exploitation requires a valid low-privilege account on the Oracle E-Business Suite / Enterprise Command Center Framework instance (CVSS PR:L) plus network HTTP access to the ECC application tier; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The affected configuration is specifically Oracle Enterprise Command Center Framework V16, Core component. Limiting factors: the attacker must already be authenticated to EBS at some privilege level, so purely anonymous internet exploitation is not possible per the vector, and only deployments that have ECC provisioned and network-reachable are exposed. The advisory states no non-default feature toggle requirement.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, base 8.3) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high integrity and availability impact but only low confidentiality impact. This is a genuine priority for organizations running Oracle EBS with ECC exposed, because the sole barrier is a low-privilege account - common in large ERP deployments with many users. Countervailing signals: no EPSS score was provided, the CVE is not in CISA KEV, and no POC is known, so there is no evidence of active or imminent widespread exploitation. SSVC-style reasoning: exploitation status is 'none' observed, automatable is uncertain (required authentication usually lowers automatability), and technical impact is high given full data tampering plus DoS. Net: high-severity by design but currently theoretical exploitation - patch on Oracle's CPU cadence rather than as an emergency zero-day. The requirement for a valid low-privilege EBS login materially narrows the realistic attacker population versus an unauthenticated flaw.

An attacker who has obtained or been issued a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Enterprise Command Center Framework, abusing the flaw to modify or delete critical ECC-accessible data and read a subset of other users' data. The same request path can be repeated to force a complete, repeatable crash of the framework, denying service to legitimate ERP users. No public proof-of-concept is known, so exploitation would require an attacker to independently develop the technique.