What is the CVSS score of CVE-2026-60582?

CVE-2026-60582 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Enterprise Command Center Framework are affected by CVE-2026-60582?

Oracle Enterprise Command Center Framework V16-a core Oracle E-Business Suite financial and operational platform component-contains a critical data tampering vulnerability accessible to any…

How to fix or mitigate CVE-2026-60582?

Within 24 hours, run inventory scans to identify all Oracle EBS instances running Framework V16 and document business criticality; immediately restrict Framework administrative access to named, monitored user accounts and disable non-administrative access where feasible. Within 7 days, implement network-level access controls (firewall rules, WAF) limiting Framework HTTP traffic to authorized administrator workstations/subnets, enable audit logging of all Framework data modifications, and brief operations and finance teams on data tampering indicators. Within 30 days, establish daily offline backups of critical EBS financial tables with 30-day retention, continuously monitor Oracle security advisories for Framework V16 patch release with deployment automation ready, and conduct forensic audit of database change logs for suspected unauthorized modifications.

Oracle Enterprise Command Center Framework CVE-2026-60582

EUVD-2026-46944 HIGH

SQL Injection (CWE-89)

2026-07-21 secalert_us@oracle.com

GHSA-jxh9-vfv6-j5g7

SQLi Oracle Enterprise Command Center Framework

8.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

8.3 HIGH

Network HTTP-reachable with low complexity and a low-privilege account (PR:L); high integrity and availability from data tampering and full DoS, only partial data read so C:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:31 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.3

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Command Center Framework accessible data as well as unauthorized read access to a subset of Oracle Enterprise Command Center Framework accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).

AnalysisAI

Authenticated data tampering and denial of service in Oracle Enterprise Command Center Framework V16 (a Core component of Oracle E-Business Suite) lets a low-privileged attacker with network HTTP access create, delete or modify critical data, read a subset of accessible data, and force a complete, repeatable crash (full DoS). Oracle rates it CVSS 3.1 8.3 (C:L/I:H/A:H) and disclosed it in the Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it attractive to any actor already holding even limited EBS credentials.

Technical ContextAI

Oracle Enterprise Command Center Framework (ECC) is the visualization and analytics layer bundled with Oracle E-Business Suite, delivering dashboard 'command centers' that aggregate and drill into ERP data across modules such as Order Management, Inventory, and Financials. The affected 'Core' component underpins the framework's data handling and request processing exposed over HTTP through the EBS application tier. Oracle assigned no CWE (CWE: N/A) and the advisory does not name the exact flaw class; however, the impact profile - attacker-controlled create/delete/modify of critical data plus a repeatable hang/crash - is consistent with an authorization or server-side input-handling weakness reachable by authenticated low-privilege users. No CPE strings were supplied in the intelligence sources, so the exact affected configuration must be taken from Oracle's version designation (V16).

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish standalone version numbers for ECC outside the CPU bundle, so administrators should download and apply the CPU July 2026 patch set for their EBS/ECC environment and follow the referenced patch documents for V16. No specific fixed build string was provided in the input, so verify the exact patch number in the CPU advisory for your platform. As compensating controls until patching, restrict network reachability of the ECC/EBS application tier to trusted internal networks and VPN users only (trade-off: may break legitimate remote ERP access), tighten EBS account provisioning and remove or disable unused low-privilege accounts that could be abused (trade-off: administrative overhead), and monitor ECC HTTP endpoints and application logs for anomalous create/delete/modify operations and repeated crash conditions (trade-off: detection only, not prevention).