Oracle Enterprise Command Center Framework allows an unauthenticated attacker to exploit a vulnerability over HTTPS that, combined with human interaction, can result in the creation, deletion, or modification of critical data. The flaw enables an attacker to gain unauthorized control over framework data, potentially leading to full exposure of all accessible data.

Oracle Corporation’s Enterprise Command Center Framework – affected releases include version 15 and version 16.

The CVSS base score of 8.1 signifies high severity with substantial confidentiality and integrity impacts. Despite a very low EPSS score (<1%), the vulnerability remains exploitable over a network-facing HTTPS interface without prior authentication, though it requires the involvement of a legitimate user to execute. The flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation at the time of analysis. An attacker would target the HTTPS endpoint, persuade or wait for a legitimate user to interact, and then exploit the lack of proper access control to compromise or modify data.