CVE-2026-46897 is a critical vulnerability in the Oracle Enterprise Command Center Framework component of Oracle E-Business Suite, affecting versions V15 and V16. It allows a low privileged attacker with network access via HTTP to compromise the framework, resulting in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The vulnerability has a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. Oracle’s June 2026 Critical Security Patch Update advisory addresses this vulnerability among others and strongly recommends applying patches promptly. No explicit patch version or fix is detailed in the advisory, so patch status remains unconfirmed. Mitigation options include applying the Critical Security Patch Update and blocking required network protocols or removing unnecessary privileges to reduce attack risk.

Successful exploitation of CVE-2026-46897 can lead to unauthorized creation, deletion, or modification of critical data within Oracle Enterprise Command Center Framework. Attackers may gain unauthorized access to all data accessible by the framework and cause a partial denial of service. The vulnerability affects confidentiality, integrity, and availability, with confidentiality and integrity impacts rated high and availability impact rated low. The scope of impact may extend beyond the framework to additional Oracle products.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing privileges or access to packages from users who do not need them. These mitigations may impact application functionality, so they should be tested carefully. Patch status is not yet confirmed; users should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for updates and patch availability.