Oracle Enterprise Command Center Framework’s core component contains a vulnerability that is easily exploitable by an attacker with network access over HTTP. An attacker with low privilege can compromise the framework, and due to the scope change, additional products that rely on the framework may also be impacted. Successful exploitation results in full takeover of the affected instance, providing control over all data and functions of the framework.

The vulnerability affects Oracle Corporation’s Oracle Enterprise Command Center Framework, specifically versions 15 and 16. Users running these releases are at risk.

The CVSS v3.1 base score of 9.9 indicates a critical threat with Confidentiality, Integrity and Availability impacts, and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C reflects that a network attacker with low privilege can change the vulnerability’s scope. Although the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, the high severity score and the potential for complete takeover warrant immediate attention.