CVE-2026-83356

Unauthorized Data Access via HTTP in Oracle Enterprise Command Center Framework

Published Sep 15, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Enterprise Command Center Framework product of Oracle E-Business Suite (component: Security). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Command Center Framework. While the vulnerability is in Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Analysis

Technical impact

The flaw occurs in the Security component of Oracle Enterprise Command Center Framework. It stems from improper enforcement of access controls over HTTP interfaces, allowing a low‑privileged user who can reach the endpoint to read data that the framework is meant to protect. The scope change noted in the advisory indicates that integrations with other Oracle products that rely on the same framework might also be exposed to the same data‑exposure risk.

Affected Systems

Oracle Corporation’s Enterprise Command Center Framework version 16 is affected. The vulnerability is limited to the Security component and no other products or versions are explicitly listed by the CNA. However, the scope change suggests that other components or products that embed or interact with the framework could be impacted as well.

Risk and Exploitability

The CVSS 3.1 base score of 7.7 classifies this as a high‑severity vulnerability. The EPSS score of less than 1 % indicates that exploitation is not widely observed at this time, but the potential for data exposure remains significant. The attack requires only a network‑level presence via HTTP and low privileges, making it relatively easy for an adversary to reach the target. Although it is not yet in the CISA KEV catalog, the combination of high confidentiality impact and scope expansion warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Enterprise Command Center Framework

affected

Version	Status	Constraints
`V16`	affected	—

No data.

Vendor Product Versions

Oracle

Enterprise Command Center Framework

Version	Status	Scheme	Platform
`V16`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Configure firewalls or network segmentation to allow HTTP traffic to the Enterprise Command Center Framework only from trusted internal hosts, blocking all external access.
Audit and tighten role‑based access controls within the framework to ensure that users obtain only the permissions necessary for their duties and that HTTP endpoints enforce these controls.
Monitor the framework’s access logs for anomal attempts from unidentified sources, and investigate any suspicious activity promptly.
Stay alert for Oracle security advisories related to this vulnerability and apply future patches or workarounds as they become available.

Generated by OpenCVE AI on September 20, 2026 at 07:09 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.340% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 24, 2026 4:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 20, 2026 7:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Unauthorized Data Access via HTTP in Oracle Enterprise Command Center Framework
Weaknesses		CWE-200 CWE-284

Sep 18, 2026 9:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Low‑Level Network Exploit in Oracle Enterprise Command Center Framework Enables Unauthorized Data Access
Weaknesses	CWE-200 CWE-284

Sep 17, 2026 12:00 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Low‑Level Network Exploit in Oracle Enterprise Command Center Framework Enables Unauthorized Data Access
Weaknesses		CWE-200 CWE-284

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Enterprise Command Center Framework product of Oracle E-Business Suite (component: Security). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Command Center Framework. While the vulnerability is in Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
First Time appeared		Oracle Oracle enterprise Command Center Framework
CPEs		cpe:2.3:a:oracle:enterprise_command_center_framework:v16:::::::*
Vendors & Products		Oracle Oracle enterprise Command Center Framework
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`