Oracle Enterprise Command Center Framework EUVD-2026-37389

Attacker must hold a valid low-privileged authenticated session against an Oracle E-Business Suite deployment that has Oracle Enterprise Command Center Framework V15 or V16 enabled, and must be able to reach the ECC HTTP endpoints - typically this means a corporate EBS account reachable from the internal network or VPN. Limiting factors: PR:L means anonymous access is not sufficient, EBS/ECC is normally not internet-exposed which constrains the attacker population to insiders and credential-theft scenarios, and only the V15 and V16 release lines of the ECC framework are affected - sites still on earlier ECC releases or without ECC enabled are not exposed.

The CVSS 3.1 base score of 9.9 is driven primarily by the scope change (S:C) and combined high confidentiality and integrity impact - a legitimate but low-privileged EBS user can read, modify, and delete data across ECC and adjacent integrated products. AV:N/AC:L/PR:L/UI:N makes exploitation straightforward once an attacker holds any authenticated EBS account, which is realistic in large enterprises where EBS user counts are high and credential reuse or phishing is common. Counterbalancing factors: no public POC identified, not in CISA KEV, EPSS not provided, and ECC is typically deployed behind enterprise perimeter controls rather than internet-exposed. The Oracle Critical Patch Update advisory is the sole intelligence source, so exploit maturity is unknown - treat this as high priority for any organization running EBS with ECC enabled, but not yet evidence of mass exploitation.

A staff-level employee or a contractor with a standard EBS account - or an external attacker who has phished such credentials - sends crafted HTTP requests to the Oracle ECC framework endpoints exposed within their EBS deployment. Because of the scope-change authorization flaw, those requests are honored against data sets and functions that belong to other EBS products the user should not be able to touch, allowing them to exfiltrate sensitive HR, financial, or supply-chain records and tamper with master data. No public POC exists at the time of analysis, so any real attack would require independent vulnerability research or post-patch diffing.