HarborGuardharborguardDatabase
Back to search
CRITICALCVE-2026-46895Published Modified CNA oracle

CVE-2026-46895: Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core)

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Metrics

CVSS v3.1
9.9
Severity
CRITICAL
Fixed in
—
Affected Products
1

Get notified

Email me when this CVE is updated: new fix versions, severity changes, or any record change.

HarborGuard Analysis

Synopsis

A critical-severity vulnerability exists in the Core component of Oracle Enterprise Command Center Framework, part of Oracle E-Business Suite versions V15 and V16. The flaw is reachable over HTTP from the network and requires only a low-privilege account, with no victim interaction needed; the CVSS scope is marked changed, meaning a successful attack can spill beyond the Framework itself into adjacent products. Successful exploitation gives an attacker full takeover of the Oracle Enterprise Command Center Framework, including complete control over confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment upstream ships one.

HarborGuard Coverage

Detection

Detection for CVE-2026-46895 is available across every HarborGuard environment: the CVE is ingested from upstream feeds within minutes of publication and matched against all customer images, including custom-built images derived from Oracle E-Business Suite base layers. Any image carrying the affected Oracle Enterprise Command Center Framework versions V15 or V16 is flagged automatically in both registry scans and CI/CD pipeline checks.

Available
Triage

HarborGuard triage capability scores this CVE at CVSS 9.9 Critical and weights it further against each customer organization's compliance policy, escalating it appropriately given the scope-changed impact. Alerts are routed to the inbox or ticketing integration configured for each environment, so the right team sees the finding without manual filtering.

Available
Patch

Because Oracle has not yet published a fix version, HarborGuard re-checks the advisory on every ingest cycle and will make a patched-image rebuild available automatically the moment an upstream fix is released. In the interim, customers can use HarborGuard policy controls to flag or block deployment of images containing the affected component, and compensating network-policy rules can be applied through the platform's workload isolation recommendations.

Pending upstream

Exploit Conditions

  • Network reachabilityRequired

    The attacker must reach the Oracle Enterprise Command Center Framework service over the network via HTTP; there is no requirement for local or physical access.

  • AuthenticationRequired

    Any low-privilege account on the application is sufficient; no administrative or elevated credentials are needed.

  • Victim interactionNot required

    No victim action such as clicking a link or opening a file is needed; the attacker can exploit the flaw entirely on their own.

  • Attack complexityDetail

    Attack complexity is low, meaning the exploit is reliable and imposes no special race conditions, memory-layout dependencies, or other environmental prerequisites.

Blast Radius

  • Reads all data accessible to the Oracle Enterprise Command Center Framework, including stored reports, dashboards, and any credentials or session tokens the application holds.
  • Modifies or deletes persisted application data, configuration, and business intelligence content within the Framework.
  • Crashes or degrades the Oracle Enterprise Command Center Framework service, making it unavailable to all users.
  • Because the CVSS scope is changed, a successful attacker gains a foothold to pivot into and compromise other Oracle E-Business Suite products sharing the same environment.

How HarborGuard Handles This

Available on HarborGuard: because no upstream fix exists for CVE-2026-46895, the platform monitors the Oracle advisory on every ingest cycle and will automatically initiate a patched-image rebuild and, for customers with auto-remediation enabled, open a PR against affected workloads the moment Oracle publishes a corrected version. While waiting for a patch, HarborGuard can enforce deployment-blocking policies on images identified as running Oracle Enterprise Command Center Framework V15 or V16, preventing the vulnerable component from reaching production. Additional compensating controls available through HarborGuard include network-policy isolation recommendations to restrict inbound HTTP access to the Framework to known, authorized source ranges, and egress filtering guidance to limit the blast radius of a scope-changed compromise. The advisory status is surfaced in the HarborGuard dashboard so teams can track Oracle's release cadence without manual polling.

See how HarborGuard automates this
Affected packages
  • Oracle Corporation / Oracle Enterprise Command Center Framework
    V15 · V16
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References