A vulnerability in the Core component of the Oracle Enterprise Command Center Framework allows a high‑privileged attacker who can reach the system over HTTP to fully compromise the application. Successful exploitation can lead to a takeover of the framework and, due to a scope change, can also impact additional Oracle E‑Business Suite products.

The affected product is Oracle Enterprise Command Center Framework versions 15 and 16. No other vendors or products are listed as impacted in the data.

The CVSS 3.1 base score of 9.1 indicates high confidentiality, integrity, and availability impact. The EPSS score is below 1%, suggesting low current exploitation likelihood, but the vulnerability is listed as not in the CISA KEV catalog. The attack vector is inferred to be external network access via HTTP, requiring the attacker to be a high‑privileged user. Even with low exploitation probability, the severity and potential scope change make this a critical risk for systems that host the affected framework or depend on other Oracle E‑Business Suite components.