Oracle ECC Framework EUVD-2026-46940

Exploitation requires an authenticated, high-privileged account on the Oracle Enterprise Command Center Framework (CVSS PR:H) with HTTP network reachability to the ECC/EBS application tier (AV:N, AC:L, no user interaction). The specific limiting factor is that the attacker must already hold high privileges within ECC/EBS - this is not remotely exploitable by an anonymous or low-privileged user despite the vendor 'Authentication Bypass' tag, which here denotes a post-authentication authorization boundary crossing (S:C) rather than pre-auth entry. Affected deployments are Oracle E-Business Suite installations running ECC Framework V16; the primary real-world enabler is an internet- or broadly-network-exposed EBS instance combined with a compromised or malicious privileged operator.

The signals are moderate and consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) shows a network-reachable, low-complexity attack that nonetheless requires PR:H - a high-privileged, authenticated account - which is the dominant limiting factor and keeps the base score at 7.6 (High) rather than Critical. The scope change (S:C) is the aggravating factor: impact can spill into other Oracle products, so blast radius exceeds ECC alone. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation; the realistic threat is a malicious or compromised privileged EBS operator, or an attacker who has already escalated to a high-privilege account. This is a real 'patch in the normal CPU cycle, prioritized for internet-exposed EBS' issue, not a drop-everything emergency, unless the EBS instance is externally reachable with weak privileged-account hygiene. Note the tension worth verifying: Oracle tags this 'Authentication Bypass' yet the vector requires PR:H, so the 'bypass' is a post-authentication authorization boundary crossing, not pre-auth access - confirm exact behavior with Oracle before deprioritizing.

A malicious insider or an attacker who has phished/compromised a high-privileged Oracle EBS operator account sends crafted HTTP requests to the ECC Framework Core component and abuses the authorization boundary to read confidential data across ECC-accessible datasets and perform limited unauthorized writes. Because the vulnerability carries a scope change, the same access can reach data belonging to other integrated Oracle products beyond ECC. No public POC is known at time of analysis, so exploitation currently presumes attacker skill and valid privileged credentials.