Oracle E-Business Suite CVE-2026-101672

Requires network reachability to the Oracle Call Center Technology RMI service (component: Internal Operations) on a system running Oracle E-Business Suite versions 12.2.3 through 12.2.15; no authentication or user interaction is needed (PR:N/UI:N). Exploitation is explicitly rated 'Difficult' (AC:H): success depends on conditions outside the attacker's control, consistent with RMI/Java deserialization attacks that need a viable gadget chain on the classpath or a specific server state. The primary limiting factor is deployment architecture - Oracle EBS RMI ports are frequently firewalled from untrusted networks, so internet-facing exposure is the main real-world precondition that elevates risk; internal-only RMI exposure substantially narrows the attack surface.

This is a genuinely serious vulnerability but one whose real-world exploitation signals are mixed. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 HIGH) confirms a network-reachable, unauthenticated flaw delivering full confidentiality, integrity and availability impact - i.e. complete takeover of Oracle Call Center Technology. The critical mitigating signal is AC:H ('Difficult to exploit' per Oracle's own wording), meaning successful attack requires conditions outside the attacker's control (e.g. a specific RMI deserialization gadget, timing, or environmental state). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization - this is a high-CVSS issue without current exploitation telemetry rather than a confirmed in-the-wild threat. Priority should still be elevated because Oracle EBS RMI flaws (historically Java deserialization) have repeatedly been weaponized after patch release, and PR:N means no credentials are needed. Conflicting signal to note explicitly: the input Tags label this 'Information Disclosure', but the CVSS vector and description describe full C/I/A takeover - the tag understates the impact and should not be used to down-prioritize. Treat as a patch-soon item (part of Oracle CPU October 2026), weighted higher where the RMI interface is network-exposed.

An unauthenticated attacker with network reachability to the Oracle Call Center Technology RMI listener sends a crafted RMI request (characteristically a malicious serialized Java object) to the Internal Operations component. Because AC:H applies, the attacker must satisfy specific preconditions (e.g. a usable deserialization gadget chain or particular server state), but a successful attack yields complete takeover of the product. No public exploit code has been identified at time of analysis.