Oracle Advanced Inbound Telephony CVE-2026-34275

The affected system must be running Oracle E-Business Suite 12.2.3-12.2.15 with the Oracle Advanced Inbound Telephony (IEO) module deployed and its Setup and Administration HTTP endpoints reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions apply beyond network reachability - remote unauthenticated exploitation over HTTP against affected configurations, with no authentication, no user interaction, and low complexity. The primary limiting factors are therefore: whether the Advanced Inbound Telephony module is actually installed and enabled (it is an optional CRM/telephony component, not core EBS), and whether its HTTP interface is exposed to the attacker's network position versus segmented behind VPN or a URL firewall.

The signals are mixed and warrant nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a maximally severe, network-reachable, unauthenticated, low-complexity flaw with total CIA impact, and SSVC independently corroborates this by rating technical impact 'total' and the flaw 'automatable: yes' - meaning it can be reliably scripted at scale. Against that, the EPSS score is very low (0.04%, 13th percentile) and SSVC exploitation status is 'none' (no observed exploitation), and it is not on CISA KEV, so there is no evidence of active use yet. The low EPSS is characteristic of a freshly disclosed Oracle CPU item that has not yet accumulated public exploit tooling or telemetry, not evidence of low real-world danger - the combination of unauthenticated network access, total impact, and automatability makes this a genuine high priority, especially for internet-exposed EBS instances. Note a caveat: Oracle's CPU wording ('easily exploitable') and the CWE-306 root cause are consistent with the vector, but Oracle does not publish technical detail, so the exact vulnerable endpoint is not independently verifiable from the provided data.

An attacker who can reach the EBS HTTP interface (for example an internet-exposed or intranet-reachable Advanced Inbound Telephony deployment) sends crafted HTTP requests directly to the unauthenticated Setup and Administration function, bypassing login entirely. Because attack complexity is low and no privileges or user interaction are required, the attacker gains full control of the Advanced Inbound Telephony product and can read, alter, or destroy its data and configuration. No public exploit code is identified at time of analysis, but the flaw's low complexity and 'automatable' rating mean a working exploit could be scripted quickly once details emerge.