CVE-2026-46901 is a critical security vulnerability affecting Oracle Enterprise Command Center Framework versions V15 and V16. It permits a low privileged attacker with network access over HTTP to compromise the framework, with a scope change potentially impacting other Oracle products. The vulnerability allows unauthorized creation, deletion, or modification of critical data, full unauthorized access to all accessible data within the framework, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security fixes and strongly recommends applying patches promptly. No specific patch versions for this product are detailed in the advisory, and no known exploits in the wild are reported at this time.

Successful exploitation of CVE-2026-46901 can result in unauthorized creation, deletion, or modification of critical data within Oracle Enterprise Command Center Framework. Attackers can gain unauthorized access to all data accessible by the framework and cause partial denial of service conditions. The vulnerability affects confidentiality, integrity, and availability with high severity, as reflected by a CVSS 3.1 score of 9.9. The scope of impact may extend beyond the framework to additional Oracle products due to the nature of the vulnerability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Customers should apply these patches as soon as possible to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them, though these measures may impact application functionality. No official fix version is explicitly stated in the advisory; therefore, patch status should be confirmed by consulting the vendor advisory directly at https://www.oracle.com/security-alerts/cspujun2026.html.