EUVD-2026-37260Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS credentials
-
DeliveryReach EBS application tier over HTTP
-
ExploitSend crafted request to Internal Operations endpoint
-
ExecutionExploit Advanced Outbound Telephony flaw
-
PersistTake over Telephony module
-
ImpactRead and tamper with outbound campaign data
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network HTTP reach to the Oracle E-Business Suite application tier where the Advanced Outbound Telephony module is deployed, and (2) a valid low-privileged EBS user session (PR:L per the vendor-supplied CVSS vector) - no user interaction and no admin privileges are needed. Exploitation is limited to EBS 12.2.3 through 12.2.15 installations that actually have the Advanced Outbound Telephony product licensed and the Internal Operations component enabled; environments where the EBS application tier is firewalled to the internal network or where the Telephony module is not deployed are not reachable by external attackers. |
| Impact | The CVSS 3.1 base score of 8.8 reflects a high-severity, easily exploitable issue: network-reachable over HTTP, low complexity, and only low privileges required for full CIA compromise. EPSS data was not supplied, and the CVE is not on the CISA KEV list, with no public exploit identified at time of analysis - so the signals point to a high-impact but currently un-weaponized flaw. Oracle EBS is a high-value enterprise target historically subject to mass exploitation once PoCs surface (see CVE-2022-21587 and CVE-2024-21287 patterns), so even without active exploitation evidence this should be prioritized in the June 2026 CPU patching cycle, particularly for EBS instances that expose the application tier beyond the corporate perimeter. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged Oracle EBS account - for example through phishing of a call-center user or reuse of leaked credentials - sends a crafted HTTP request to an Advanced Outbound Telephony endpoint in the Internal Operations component and takes over the module, gaining the ability to read, modify, and disrupt outbound campaign data and dialing operations. No public exploit identified at time of analysis, but the low attack complexity and Oracle's 'easily exploitable' wording suggest a PoC would be straightforward once the patch is reverse-engineered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Account takeover in Oracle Advanced Outbound Telephony (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the component over HTTP. The Internal Operations component is exposed to authenticated users with network reach, and successful exploitation yields high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the patch available per vendor advisory in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), covering the full 12.2.3-12.2.15 range; no exact post-patch build string was published in the available input, so reference the CPU document for the specific bundle patch number for your release. As compensating controls until patching, restrict HTTP access to the Advanced Outbound Telephony URLs at the reverse proxy or Oracle HTTP Server level (URL firewall / mod_rewrite deny rules) to known call-center workstations, audit and disable EBS user accounts that do not require the Telephony responsibilities (removing the low-privilege foothold required), and ensure the EBS application tier is not internet-exposed - side effects include loss of remote agent connectivity and potential disruption to outbound dialing operations, so coordinate with the contact-center team before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Advanced Outbound Telephony is a module within the Oracle E-Business Suite (EBS) used for predictive and progressive outbound dialing in call-center operations. The flaw resides in the Internal Operations component, which is reachable over HTTP within the EBS application tier. No CWE is published by the reporter (Oracle's Critical Patch Update advisories typically omit CWE mappings), so the precise weakness class is not disclosed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a server-side authorization or input-handling flaw exploitable by any authenticated EBS user with HTTP access to the module.
Know when Oracle Advanced Outbound Telephony gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable (AV:N), low complexity per Oracle (AC:L), requires an authenticated low-privileged EBS user (PR:L), no user interaction, and yields full takeover of the module (C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Outbound Telephony. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A high-severity account takeover vulnerability (CVSS 8.8) in Oracle Advanced Outbound Telephony (E-Business Suite versions 12.2.3-12.2.15) allows authenticated remote attackers to fully compromise the component. Although no public exploit identified at time of analysis, organizations running affected versions face significant risk of unauthorized access to critical telephony operations and sensitive data exposure. With no vendor patch currently available, immediate compensating controls are essential.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict firewall and network access to the Internal Operations component to authenticated users with verified business need only; (2) enforce multi-factor authentication for all component access where supported; (3) implement continuous logging and real-time monitoring with automated alerting for authentication anomalies; (4) conduct privileged access review and revoke unnecessary permissions; (5) apply network segmentation to isolate the telephony component from general network infrastructure; (6) establish incident response procedures for unauthorized access detection; (7) prepare and track Oracle patch release timelines for upgrade execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote unauthenticated compromise of Oracle Advanced Outbound Telephony (Oracle E-Business Suite, Internal Operations co
Account takeover in Oracle Advanced Outbound Telephony (E-Business Suite component, versions 12.2.3 through 12.2.15) all
GitHub PoC
Exploit-DB