What is the CVSS score of EUVD-2026-46941?

EUVD-2026-46941 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle ECC Framework are affected by EUVD-2026-46941?

Oracle Enterprise Command Center Framework V16, a core component of Oracle E-Business Suite used by many organizations for financial and supply-chain management, contains a high-severity…

How to fix or mitigate EUVD-2026-46941?

Within 24 hours, complete an inventory of all Oracle E-Business Suite V16 deployments and document which systems contain Enterprise Command Center Framework, noting network accessibility from adjacent segments (internal networks, DMZ, partner connections). Within 7 days, implement network segmentation isolating affected systems from untrusted or less-controlled network segments, restrict Layer 2/3 access to Oracle infrastructure through VLAN isolation or physical network boundaries, and enable comprehensive audit logging of all data access operations on the framework with real-time alerting for anomalies. Within 30 days, establish a vendor patch monitoring process with Oracle, evaluate feasibility of upgrading to a patched E-Business Suite version, and conduct threat-hunting activities to detect any signs of network reconnaissance or unauthorized data modification on affected systems.

Oracle ECC Framework EUVD-2026-46941

| CVE-2026-60579 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5564-p6x7-m79f

Authentication Bypass Oracle Enterprise Command Center Framework

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.0 HIGH

Adjacent-segment access only (AV:A) and difficult, condition-dependent exploitation (AC:H) with no auth (PR:N); high C/I but no availability impact, and scope change to other products (S:C).

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:33 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Enterprise Command Center Framework executes to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Command Center Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Enterprise Command Center Framework V16 (a component of Oracle E-Business Suite) lets an unauthenticated attacker positioned on the adjacent hardware communication segment read, create, delete, or modify all data the framework can access, with a scope change extending impact to additional Oracle products. Oracle rates it CVSS 3.1 8.0 (AV:A/AC:H), reflecting high confidentiality and integrity impact but a difficult, non-remote attack path. This was reported through Oracle's own Critical Patch Update process with no public exploit identified at time of analysis.

Technical ContextAI

Oracle Enterprise Command Center Framework (ECC) is an analytics and information-discovery layer bundled with Oracle E-Business Suite, used to build interactive dashboards over EBS transactional data; the affected component is 'Core'. The advisory does not assign a CWE (CWE: N/A), and the vendor description provides no root-cause detail, but the intelligence tag 'Authentication Bypass' suggests a flaw allowing access without valid credentials, consistent with the CVSS PR:N (no privileges required). The CVSS scope change (S:C) indicates the vulnerable ECC component can be leveraged to affect resources beyond its own security authority - i.e., other integrated EBS products or data stores.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle publishes ECC/EBS patch sets through the CPU rather than a single tagged version number, so consult the CPU matrix for the exact patch applicable to your ECC V16 / E-Business Suite deployment. Until patched, reduce exposure of the adjacent attack vector by network-segmenting the ECC host so only trusted management systems share its Layer-2 segment and by placing EBS/ECC hosts behind VLAN isolation and strict access-control lists - trade-off: may disrupt legitimate integrations that rely on flat network reachability, so validate connectivity for dependent EBS services first. Monitor the ECC and EBS hosts for anomalous data access given the confidentiality/integrity impact. Do not rely on authentication controls alone given the 'Authentication Bypass' indicator.