What is the CVSS score of CVE-2026-60491?

CVE-2026-60491 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Advanced Inbound Telephony CVE-2026-60491

EUVD-2026-46869 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c6qp-px23-5cj3

Authentication Bypass Denial Of Service Oracle Advanced Inbound Telephony

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible HTTP endpoint requires low-privilege credential (PR:L, AV:N); all three impact domains are partial with no scope change, consistent with description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: SDK client integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Inbound Telephony accessible data as well as unauthorized read access to a subset of Oracle Advanced Inbound Telephony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Partial data compromise and service disruption in Oracle Advanced Inbound Telephony 12.2.3-12.2.15 (SDK client integration component) is exploitable by a low-privileged attacker over HTTP without requiring user interaction. Successful exploitation allows unauthorized read access to a subset of telephony data, unauthorized insert, update, or delete operations on accessible data, and partial denial of service against the affected module. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence.

Technical ContextAI

Oracle Advanced Inbound Telephony is a call center integration module within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform. The vulnerable component is the SDK client integration, which exposes HTTP-based interfaces used to integrate telephony systems with the EBS application tier. The vulnerability exists across the 12.2.x maintenance track from 12.2.3 through 12.2.15. No CWE identifier has been assigned, which is atypical for Oracle CPU disclosures and limits root-cause classification; however, the low-privilege, low-complexity, no-user-interaction CVSS profile (AV:N/AC:L/PR:L/UI:N) suggests an insufficiently controlled API endpoint rather than a memory-safety issue. Oracle E-Business Suite typically runs on Oracle Application Server or Oracle WebLogic, and the SDK integration layer likely exposes REST or SOAP endpoints accessible over the internal HTTP stack.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed beyond the CPU advisory - consult the Oracle support portal for the specific patch ID applicable to your 12.2.x installation. As a compensating control, restrict network access to the SDK client integration HTTP endpoints to trusted internal subnets or authenticated VPN clients only, reducing the effective attack surface by limiting which low-privileged accounts can reach the endpoint. Additionally, review and revoke any overly broad low-privilege service accounts that have access to the Inbound Telephony module, as PR:L exploitation requires a valid credential. Disabling the SDK client integration component entirely is an option for organizations not actively using third-party telephony integrations, though this would disable associated call center functionality.