CVE-2026-46897 affects Oracle Enterprise Command Center Framework versions 15 and 16. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the framework. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. Oracle’s June 2026 Critical Security Patch Update advisory addresses this and other vulnerabilities, strongly recommending customers apply patches promptly. No specific patch version or fix details for this vulnerability are explicitly stated in the advisory content provided.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Enterprise Command Center Framework. Attackers may gain unauthorized access to all data accessible by the framework and can cause a partial denial of service condition. The vulnerability affects confidentiality, integrity, and availability, with confidentiality and integrity impacts rated high and availability impact rated low. The scope of impact extends beyond the framework itself, potentially affecting additional Oracle products.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users who do not need them. These mitigations may impact application functionality, so they should be implemented carefully. Patch status is not explicitly confirmed for this vulnerability in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and instructions.