Oracle ECC Framework EUVD-2026-37219

Attacker must (1) reach the Oracle ECC Framework HTTPS endpoint on an EBS deployment running ECC V15 or V16, and (2) hold valid credentials for any low-privileged EBS account (PR:L) - no admin role, no MFA bypass, and no user interaction (UI:N) is required, and attack complexity is low (AC:L). Exploitation is limited to environments that have deployed the ECC Framework component (it is an optional EBS add-on, not installed in every EBS estate); EBS instances that do not run ECC, or whose ECC endpoints are firewalled off from untrusted networks, are not directly exposed even though they may still be reachable via the scope-change impact if another compromised host can reach ECC internally.

This is a genuine priority despite the low-privilege requirement. CVSS 3.1 is 9.9 with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - network reachable over HTTPS, low complexity, no user interaction, and a scope change meaning the blast radius extends beyond ECC into other EBS products. PR:L is trivially satisfied in EBS environments where ordinary employees, contractors or self-service users hold accounts, effectively reducing this to an insider/credential-phishing-grade pre-auth issue. EPSS and CISA KEV status are not provided in the input, and no POC reference is listed, so exploitation probability cannot be quantified; however, EBS is a recurring target of ransomware and extortion crews (e.g., recent Cl0p activity against EBS components), and Oracle CPU bugs are frequently reverse-engineered from patch diffs within weeks of release.

An attacker who has obtained any low-privilege EBS account - for example a self-service employee login harvested via phishing or reused credentials - connects to the ECC Framework over HTTPS and issues a crafted request to a vulnerable ECC endpoint, gaining full control of the ECC service and, through the CVSS scope change, the ability to read or tamper with data in connected EBS modules such as Financials or HCM. No public exploit identified at time of analysis, but Oracle CPU patches are routinely diffed by researchers, so a working exploit is plausible within weeks.