Oracle Advanced Outbound Telephony CVE-2026-60829

Exploitation requires network HTTP access to the Oracle E-Business Suite application tier and an authenticated low-privileged account on the target (CVSS PR:L), against affected Advanced Outbound Telephony versions 12.2.3-12.2.15 via the Internal Operations component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is that valid low-privilege EBS credentials (or an accessible authenticated session) are needed - this is not a fully unauthenticated flaw - and the vulnerable module must be deployed and reachable, so environments that do not license/enable Advanced Outbound Telephony or that isolate the EBS tier from untrusted networks materially reduce risk. Exploitation is confined to supported 12.2.x releases.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a serious, easily-exploitable network flaw requiring only low privileges and no user interaction, with full impact on confidentiality, integrity and availability - Oracle itself labels it 'easily exploitable.' However, several priority-moderating signals are missing: no EPSS score, no SSVC decision, and no CWE were provided, so automatability and technical-impact framing cannot be independently corroborated. The vulnerability is NOT in CISA KEV and no POC/exploit code was identified, so this is a high-severity-by-CVSS issue without evidence of active or imminent exploitation. One point of tension worth verifying: Oracle's freeform tags label this 'Information Disclosure,' yet the CVSS vector and description assert full C/I/A takeover - the vector should be treated as authoritative over the tag, but the discrepancy should be confirmed against the Oracle CPU advisory. Because EBS is an internet-and-intranet-exposed ERP platform and only low privileges are needed, defenders running affected 12.2.x versions should treat this as a genuine patch priority even absent KEV/EPSS data.

A user holding any low-privilege Oracle E-Business Suite account (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the Advanced Outbound Telephony Internal Operations component over the network, requiring no additional user interaction. By abusing the flaw they escalate to full control of the module, reading and altering telephony/campaign data and disrupting the service. No public proof-of-concept is currently known, so exploitation would require an attacker to independently develop the technique.