This vulnerability affects Oracle Enterprise Command Center Framework versions V15 and V16. It is easily exploitable by a low privileged attacker over the network via HTTPS, resulting in complete compromise of the product. The CVSS 3.1 base score is 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially impacting additional Oracle products. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying the update promptly. However, the advisory does not explicitly confirm the availability of a dedicated patch for this CVE or provide a remediation level. Oracle emphasizes the importance of applying security patches without delay to prevent exploitation.

Successful exploitation allows an attacker with low privileges and network access to take over the Oracle Enterprise Command Center Framework, impacting confidentiality, integrity, and availability. The vulnerability’s scope change means it may also affect other Oracle products, increasing the potential impact. The CVSS score of 9.9 reflects critical risk, with network attack vector, low attack complexity, no user interaction, and privileges required but with complete system compromise possible.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges or access to vulnerable packages from users. These mitigations may impact application functionality and should be tested accordingly. Patch status is not explicitly confirmed for this CVE in the advisory; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.