CVE-2026-46900

{
  "id": "CVE-2026-46900",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T10:54:07.737",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are V15 and  V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Command Center Framework.  While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Oracle Enterprise Command Center Framework de Oracle E-Business Suite (componente: Core). Las versiones compatibles afectadas son V15 y V16. Una vulnerabilidad fácilmente explotable permite a un atacante con bajos privilegios y acceso a la red a través de HTTPS comprometer Oracle Enterprise Command Center Framework. Aunque la vulnerabilidad se encuentra en Oracle Enterprise Command Center Framework, los ataques pueden tener un impacto significativo en productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Enterprise Command Center Framework. Puntuación Base CVSS 3.1 de 9.9 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Enterprise Command Center Framework",
          "versions": [
            {
              "version": "V15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "V16",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-17T00:00:00+00:00",
          "id": "CVE-2026-46900",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:enterprise_command_center_framework:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1745FFD-7C3C-424D-8994-00E0BBE213D2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:enterprise_command_center_framework:16:*:*:*:*:*:*:*",
              "matchCriteriaId": "3DD2A4E3-E0BA-47EA-BB5E-CA96963CF5B8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cspujun2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}