What is the CVSS score of CVE-2026-34275?

CVE-2026-34275 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle Advanced Inbound Telephony are affected by CVE-2026-34275?

Oracle Advanced Inbound Telephony within E-Business Suite versions 12.2.3-12.2.15 is vulnerable to complete remote takeover by unauthenticated attackers without requiring authentication or user…

How to fix or mitigate CVE-2026-34275?

Immediate actions (24 hours): Inventory all Oracle E-Business Suite instances running versions 12.2.3-12.2.15 and identify which have Advanced Inbound Telephony enabled; immediately restrict all network access to the Setup and Administration component to trusted administrative networks only via firewall rules or network segmentation; enable comprehensive audit logging for all connection attempts to this component. Within 7 days: If operationally feasible, disable or isolate the Advanced Inbound Telephony module entirely; alternatively, deploy a Web Application Firewall (WAF) with rules to block all unauthenticated HTTP/HTTPS requests to vulnerable endpoints; establish 24/7 real-time monitoring and alerting for exploitation attempts. Within 30 days: Maintain continuous monitoring of Oracle's Critical Patch Update channel for a patch to version 12.2.16 or later; prepare and test a patching process to deploy security fixes immediately upon release; if no patch is forthcoming within a reasonable timeframe, evaluate urgently upgrading to a current E-Business Suite release or replacing Advanced Inbound Telephony with a supported alternative.

Oracle Advanced Inbound Telephony CVE-2026-34275

EUVD-2026-24350 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-21 oracle

GHSA-h2wx-vfx5-xwj8

Authentication Bypass Oracle Oracle Advanced Inbound Telephony Oracle Corporation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Missing authentication (CWE-306) on a network HTTP function gives AV:N/AC:L/PR:N/UI:N, and full product takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:26 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24350

CVE Published

Apr 21, 2026 - 20:35 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Advanced Inbound Telephony (a module within Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote, unauthenticated attacker over HTTP against the Setup and Administration component, per Oracle's April 2026 Critical Patch Update. Classified as a missing-authentication authentication bypass (CWE-306) with a 9.8 CVSS, successful exploitation yields complete confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis, and EPSS probability is low (0.04%), but CISA's SSVC assessment rates the technical impact as total and the flaw as automatable.

Technical ContextAI

Oracle Advanced Inbound Telephony (part number IEO, marketed as part of Oracle Telephony Manager/Interaction Center) is a CRM-suite telephony-integration module bundled inside Oracle E-Business Suite 12.2, an enterprise ERP/CRM platform typically deployed on Oracle Application Server/WebLogic front-ends reachable over HTTP. The affected element is the Setup and Administration component (CPE cpe:2.3:a:oracle_corporation:oracle_advanced_inbound_telephony). The root cause is CWE-306 (Missing Authentication for a Critical Function): a sensitive administrative/setup function is exposed without enforcing an authentication check, so requests that should require a valid session are honored from anonymous callers. Because this is an authentication bypass rather than a memory-safety bug, exploitation is deterministic and does not depend on runtime conditions such as heap layout, which is consistent with the 'automatable: yes' SSVC rating.

RemediationAI

Apply the fixes delivered in the Oracle April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html); Oracle ships EBS security fixes as cumulative CPU patches per 12.2.x code level rather than as a single named version, so identify your current 12.2.x level and apply the corresponding April 2026 CPU patch from My Oracle Support (Patch available per vendor advisory - an exact standalone fix version is not enumerated in the provided data, so do not substitute an invented version number). As a compensating control until patched, restrict network reachability of the affected Setup and Administration/telephony endpoints: remove any internet exposure of the EBS instance, place it behind VPN/allowlisted access, and use URL firewall / reverse-proxy rules to block anonymous access to the Advanced Inbound Telephony (IEO) admin paths - with the trade-off that this may break legitimate CTI/telephony integrations that call those endpoints. If the Advanced Inbound Telephony module is not actively used, disabling or de-provisioning it removes the attack surface entirely; verify no dependent Interaction Center/CRM call-center functions rely on it before doing so.