What is the CVSS score of CVE-2026-61256?

CVE-2026-61256 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Advanced Inbound Telephony CVE-2026-61256

EUVD-2026-47445 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7q8j-5qg3-frxf

Authentication Bypass Denial Of Service Oracle Advanced Inbound Telephony

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network HTTP access with low credentials required, no interaction needed; partial impact across all three properties matches description of limited data read, write, and partial DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:10 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Servers). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Inbound Telephony accessible data as well as unauthorized read access to a subset of Oracle Advanced Inbound Telephony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Advanced Inbound Telephony (versions 12.2.3 through 12.2.15) within Oracle E-Business Suite exposes a medium-severity network-exploitable flaw in its Servers component that allows low-privileged authenticated attackers to perform unauthorized data reads, data manipulation, and partial denial of service via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tracked under ENISA EUVD-2026-47445, the vulnerability carries a CVSS 3.1 base score of 6.3, reflecting its low complexity and absence of required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version range make it a meaningful risk for organizations running unpatched Oracle E-Business Suite deployments.

Technical ContextAI

Oracle Advanced Inbound Telephony is a call-center and telephony management module embedded within Oracle E-Business Suite (EBS), a widely deployed enterprise resource planning suite. The affected component is identified as 'Servers,' which likely refers to server-side request handling logic within the telephony module. The access vector is HTTP (network-reachable), consistent with EBS's web-based application tier architecture. No CWE has been assigned, leaving the precise root cause class unconfirmed; however, given the combined Confidentiality, Integrity, and Availability impact alongside low privilege requirements, likely candidates include improper authorization enforcement (CWE-285), insufficient input validation (CWE-20), or insecure direct object reference patterns common in large legacy ERP platforms. Affected versions span 12.2.3 through 12.2.15 per Oracle's advisory and ENISA EUVD data.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. Oracle CPU patches are cumulative for the E-Business Suite 12.2.x line; organizations should apply the July 2026 CPU or any later CPU that supersedes it. An exact patched version number was not independently stated in the available advisory references beyond the CPU bulletin itself - verify the specific patch ID against Oracle's My Oracle Support (MOS) portal. As a compensating control where patching is not immediately feasible, restrict network access to the Advanced Inbound Telephony Servers component to trusted internal networks only, preventing external low-privileged accounts from reaching the HTTP endpoint. Additionally, audit and minimize the number of accounts holding even low-level EBS application roles to reduce the attacker surface. These mitigations reduce exposure but do not eliminate the vulnerability.