Advanced Outbound Telephony CVE-2026-101630

Exploitation requires the attacker to already hold a low-privileged account on the Oracle E-Business Suite instance (PR:L) and to convince a different, higher-value user to perform an interaction (UI:R), such as following a crafted link or request to the Advanced Outbound Telephony component over HTTP. It applies to EBS versions 12.2.3 through 12.2.15. The dual dependency - valid credentials plus victim interaction - is the primary limiting factor; there is no availability impact, and confidentiality/integrity impact is limited (C:L/I:L). The scope change means successful attacks can extend impact to additional Oracle products beyond the Telephony component itself.

This is a moderate-severity (CVSS 3.1 base 5.4) vulnerability in Oracle Advanced Outbound Telephony, a module of Oracle E-Business Suite, disclosed in the Oracle Critical Patch Update of October 2026. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows a network-exploitable, low-complexity flaw but with two meaningful brakes: the attacker must already hold low-level privileges (PR:L) and must induce a separate victim to interact (UI:R). The scope change (S:C) and Oracle's note that attacks 'may significantly impact additional products' are the elevating factors, since compromise can reach beyond the vulnerable component. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence set, so real-world exploitation signals are currently absent - this reads as a credentialed, interaction-dependent issue rather than a mass-exploitation priority. One conflict to flag: the input Tags include 'Authentication Bypass', which contradicts the CVSS vector's PR:L (authentication required) and the description's 'low privileged attacker' language - treat the 'Authentication Bypass' characterization as unverified. Overall this is a genuine patch-in-cycle item for EBS operators, not an emergency, absent any exploitation evidence.

A low-privileged authenticated Oracle E-Business Suite user crafts a malicious link or request targeting the Advanced Outbound Telephony component and lures a more privileged user (e.g., an operator or administrator) into interacting with it over HTTP. The interaction triggers the flaw, allowing limited unauthorized read plus insert/update/delete of some Telephony-accessible data, with impact potentially spilling into adjacent EBS products due to the scope change. No public exploit code was identified at time of analysis.