CVE-2026-46900: Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core)

Synopsis

A critical-severity vulnerability affects the Core component of Oracle Enterprise Command Center Framework (part of Oracle E-Business Suite) versions V15 and V16. The flaw is reachable over HTTPS by any low-privileged authenticated user with network access, requiring no victim interaction and no complex setup. Successful exploitation gives the attacker full control over the Framework, with scope-changing impact that can spill over into additional products sharing the same environment, enabling complete takeover including reads of all data, arbitrary writes, and service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Enterprise Command Center Framework service over the network via HTTPS; no local or physical access is required.

• AuthenticationRequired

  A valid low-privilege account is sufficient; the attacker does not need admin or elevated credentials, but unauthenticated access is not enough.

• Victim interactionNot required

  The attacker can exploit this vulnerability without any action from another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental factors are needed.

Blast Radius

• A successful attacker gains full read access to all data held by the Framework, including stored credentials, session tokens, and business intelligence records.
• The attacker can write or modify any data within the Framework, corrupting reports, altering configurations, or escalating privileges further.
• The Framework process can be crashed or made unavailable, disrupting E-Business Suite operations that depend on it.
• Because the CVSS scope is changed, co-located or downstream products sharing the same environment are also at risk of compromise beyond the Framework itself.