What is the CVSS score of EUVD-2026-46938?

EUVD-2026-46938 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Enterprise Command Center are affected by EUVD-2026-46938?

Oracle Enterprise Command Center Framework V16, a critical operational component of Oracle E-Business Suite, contains a privilege-escalation vulnerability (CVSS 7.2) that allows high-privileged…

How to fix or mitigate EUVD-2026-46938?

Within 24 hours, conduct an asset inventory identifying all Oracle E-Business Suite Core instances running Enterprise Command Center Framework V16 and determine which have HTTP network exposure. Within 7 days, implement firewall rules and network segmentation to restrict HTTP access to the framework to only authorized high-privilege users, consider disabling the component if operationally feasible, and establish enhanced logging of all access attempts. Within 30 days, monitor Oracle security advisories for the Critical Patch Update release and schedule immediate patching of all affected systems upon vendor availability, including pre-production testing and staged production rollout.

Oracle Enterprise Command Center EUVD-2026-46938

| CVE-2026-60576 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-h2jp-gmjp-6x66

Authentication Bypass Oracle Enterprise Command Center Framework

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reach (AV:N), no interaction (UI:N), but the description explicitly requires a high-privileged attacker (PR:H); takeover yields full C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:34 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-based takeover in Oracle Enterprise Command Center Framework V16, a component of Oracle E-Business Suite (Core), allows a high-privileged attacker with HTTP network access to fully compromise the framework. Successful exploitation results in complete takeover with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the flaw is addressed in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Enterprise Command Center (ECC) Framework is an analytics and dashboard layer embedded in Oracle E-Business Suite (EBS), providing information-discovery and drill-down interfaces over EBS application data. The vulnerability sits in the ECC 'Core' component and is reachable over HTTP through the EBS web tier. Oracle did not assign a CWE (CWE: N/A) and does not disclose the specific weakness class per its standard CPU practice, so the exact root cause (e.g., injection, access-control, or deserialization flaw) cannot be determined from the available data; the CVSS profile (network vector, low complexity, high privilege required, full CIA impact) is consistent with an authenticated logic or access-control flaw that escalates an already-privileged account to full framework takeover.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which contains the fix for this vulnerability; consult the CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the exact ECC Framework patch and E-Business Suite prerequisites for your environment (Patch available per vendor advisory; Oracle CPUs do not publish a simple semantic fix version, so validate the specific patch number for V16 against the advisory). Because exploitation requires a high-privileged account, compensating controls until patching completes include tightly restricting and auditing high-privilege EBS/ECC accounts, enforcing least privilege, and limiting network reachability of the ECC web tier to trusted administrative networks or via VPN - trade-off: restricting ECC endpoint access may disrupt legitimate analytics users who reach dashboards over the web tier. Monitor EBS access logs for anomalous privileged activity against ECC pages as an interim detective control.