What is the CVSS score of CVE-2026-46949?

CVE-2026-46949 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Advanced Outbound Telephony are affected by CVE-2026-46949?

Oracle Advanced Outbound Telephony (Oracle E-Business Suite, Internal Operations component) versions 12.2.3-12.2.15 contain a critical vulnerability enabling unauthenticated network attackers to…

How to fix or mitigate CVE-2026-46949?

WITHIN 24 HOURS: Inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15; implement emergency firewall rules restricting network access to affected systems to whitelisted IPs only. WITHIN 7 DAYS: Deploy Web Application Firewall rules to monitor and block suspicious HTTP requests to the Internal Operations component; enable enhanced logging and alerting for all HTTP traffic to these systems; open support case with Oracle for patch availability timeline. WITHIN 30 DAYS: Complete assessment for upgrade path to version 12.2.16 or later; if upgrade not feasible within 30 days, establish long-term compensating controls as interim solution.

Oracle Advanced Outbound Telephony CVE-2026-46949

EUVD-2026-37261 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Advanced Outbound Telephony Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

HTTP-reachable EBS module with no auth or interaction (AV:N/AC:L/PR:N/UI:N); full data read and write but no availability impact, so C:H/I:H/A:N, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:57 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Outbound Telephony accessible data as well as unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Remote unauthenticated compromise of Oracle Advanced Outbound Telephony (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows attackers to read, create, modify, or delete all data accessible to the application via HTTP. Oracle rates the issue 9.1 (CVSS 3.1) due to network attack vector with no authentication and high confidentiality and integrity impact, though availability is unaffected. No public exploit identified at time of analysis, but the trivial exploitability and EBS exposure profile make it a priority patch.

Technical ContextAI

Oracle Advanced Outbound Telephony is a module of Oracle E-Business Suite (EBS) used to drive predictive and preview dialing campaigns in contact-center deployments, exposed through the EBS web tier (Oracle HTTP Server / WebLogic). The 'Internal Operations' component designation in Oracle's CPU taxonomy plus the description's emphasis on data CRUD over HTTP without authentication is consistent with a missing-authorization or authentication-bypass weakness in an exposed servlet/JSP endpoint. The official CWE was not assigned in the input, but the vendor tag 'Authentication Bypass' aligns with CWE-287/CWE-862-class root causes. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_advanced_outbound_telephony, scoped to EBS 12.2 maintenance pack levels 12.2.3 through 12.2.15.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update for E-Business Suite as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle distributes EBS fixes as patch sets layered on the affected 12.2.x release, so install the CPU patch corresponding to your current 12.2.3-12.2.15 maintenance pack rather than expecting a single 'fixed version' string. Until the CPU patch is staged through DEV/UAT, restrict reachability of the Advanced Outbound Telephony endpoints at the EBS web tier - typically by removing or disallowing the module's URLs in the Oracle HTTP Server URL firewall (url_fw.conf / mod_rewrite rules in $IAS_ORACLE_HOME) and by limiting external access to the EBS web entry points via reverse proxy/WAF ACLs to known contact-center operator networks; the trade-off is that legitimate outbound-dialing operators outside those network ranges will lose access until the patch is applied. If the Advanced Outbound Telephony module is not used in your deployment, disabling or deregistering it via Oracle Applications Manager is the cleanest compensating control. Patch status per the precision rules: patch available per vendor advisory (Oracle CPU June 2026); exact per-release patch numbers should be read directly from the CPU advisory rather than inferred.