CVE-2026-46902: Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core)

Synopsis

This is an unauthenticated remote compromise vulnerability in the Core component of Oracle Enterprise Command Center Framework, part of Oracle E-Business Suite (versions V15 and V16). An attacker with network access over HTTPS can reach the affected service without any credentials or victim interaction, and exploitation is reliable with no special conditions required. Successful exploitation results in full takeover of the Oracle Enterprise Command Center Framework instance, giving the attacker read, write, and denial-of-service capability over the system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Enterprise Command Center Framework service over the network via HTTPS; internet-exposed or internally network-accessible instances are in scope.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable endpoint is reachable by any unauthenticated caller.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no race conditions, special memory layout requirements, or other environmental prerequisites.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Enterprise Command Center Framework process, including dashboards, business intelligence data, and any credentials or session tokens stored or cached by the application.
• The attacker can write to or modify persisted application data, configuration, and any backend database rows reachable through the compromised process.
• The attacker can crash or render the Oracle Enterprise Command Center Framework service unavailable, disrupting business operations that depend on it.
• Full process-level takeover means the attacker can install backdoors, pivot to connected E-Business Suite components, or use the host as a foothold for lateral movement within the environment.