The Oracle Enterprise Command Center Framework contains a vulnerability that can be easily exploited by an attacker who has low privileges and simple network access via HTTPS. When successfully leveraged, the flaw compromising its confidentiality, integrity and availability. The CVSS vector indicates that no user interaction is needed and the attack can be performed remotely with minimal effort, resulting in full system takeover.

Oracle Corporation’s Oracle Enterprise Command Center Framework, specifically versions 15 and 16, are affected. The vulnerability resides in the Core component of Oracle E‑Business Suite.

The severity is extremely high with a CVSS score of 9.9. The EPSS score is below 1%, indicating a low but not negligible exploitation probability. It is not listed in CISA’s KEV catalog. The attack vector is anticipated to be a remote HTTPS request from a network‑local attacker with low privileges, exploiting the lack of sufficient access control to execute arbitrary commands.