Telesales CVE-2026-60793

Oracle TeleSales within E-Business Suite versions 12.2.3 through 12.2.15 contains an authentication-bypass vulnerability enabling low-privileged attackers with network access to read, modify, or delete all business data in the system. With a CVSS severity of 8.1 and no vendor patch available, this immediately threatens data integrity and confidentiality for organizations running affected versions.

Within 24 hours, identify and document all deployed Oracle E-Business Suite instances running TeleSales versions 12.2.3 through 12.2.15, and assess their network exposure to determine which systems can be safely isolated pending remediation. Within 7 days, implement layered network access controls restricting TeleSales HTTP access to specific authorized users only; enable full audit logging on all data access, creation, modification, and deletion events; and configure network-based intrusion detection rules to identify exploitation attempts. Within 30 days, engage Oracle support for a security patch timeline and begin planning a formal upgrade to a patched version outside the 12.2.3-12.2.15 range, evaluating alternative platforms if patch release timelines extend beyond acceptable risk windows for your organization.

Restrict HTTP network access to TeleSales using firewall rules and network segmentation to minimize attacker reach; enable comprehensive audit logging of all TeleSales data operations (read, create, modify, delete) to detect unauthorized activity; deploy intrusion detection signatures monitoring for exploitation attempts; consider disabling TeleSales component if not operationally critical until patched version is available.