Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Oracle E-Business Suite V16: Unauthenticated Takeover Risk

CVE-2026-60581 · published 3 months ago
Summary

Oracle's E-Business Suite, specifically version 16, has a vulnerability that makes it difficult for attackers to take control of the system. This could happen if an attacker has access to the physical hardware where the system is running. It's essential to update the system to a secure version to prevent unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle corporation oracle enterprise command center framework V16
oracle enterprise_command_center_framework 16
cpe:2.3:a:oracle:enterprise_command_center_framework:16:*:*:*:*:*:*:*
Original advisory text
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Difficult to exploit vulnerabi...
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Enterprise Command Center Framework executes to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen27 Jul 2026
Sources
CVE-2026-60581 · NVD
CVE-2026-60581 · MITRE
Track software like this
Free during beta