This vulnerability affects Oracle Enterprise Command Center Framework version V16 and permits a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and the ability to cause a hang or repeated crash leading to denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity and availability impacts. The vendor advisory does not currently specify a patch or remediation status for this vulnerability.

The vulnerability allows attackers with low privileges and network access to perform unauthorized data manipulation (creation, deletion, modification) and unauthorized partial data disclosure. It also enables denial of service conditions by causing the application to hang or crash repeatedly. These impacts affect confidentiality, integrity, and availability of the Oracle Enterprise Command Center Framework data and service.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly when available. Until a patch is applied, restrict network access to the Oracle Enterprise Command Center Framework to trusted users only and monitor for unusual activity consistent with exploitation attempts.