Advanced Inbound Telephony CVE-2026-61256

Exploitation requires: (1) a valid low-privileged account within Oracle E-Business Suite (PR:L per CVSS vector - unauthenticated exploitation is not supported by the available data); (2) network access to the target EBS instance via HTTP; (3) the Advanced Inbound Telephony module with its Servers component deployed and accessible. No user interaction is required. Exploitation is limited by the authenticated entry barrier - an attacker without any EBS credentials cannot exploit this externally. Non-default or specialized telephony configurations are not stated as requirements; the flaw appears to affect standard deployments of the Servers component across all versions 12.2.3-12.2.15. The partial impact scope (C:L/I:L/A:L) further limits what a successful attacker can achieve, constraining damage to telephony-accessible data and availability rather than full system compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a network-reachable, low-complexity flaw requiring only low-privileged credentials and no user interaction, with partial impact across all three security properties. Real-world risk is moderate rather than critical: the PR:L requirement means an attacker must already possess a valid low-privilege account in Oracle E-Business Suite, which meaningfully limits opportunistic exploitation. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing is present, and no public proof-of-concept has been identified, suggesting this is not currently under active widespread exploitation. The Oracle CPU July 2026 advisory is the sole confirmed source. The partial DoS (A:L) and limited data access impacts constrain blast radius compared to higher-impact Oracle EBS vulnerabilities. Priority should be elevated for organizations where EBS telephony modules are internet-accessible or where untrusted low-privilege accounts exist.

An attacker with a valid low-privilege Oracle E-Business Suite account - such as a call center operator or read-only EBS user - sends a specially crafted HTTP request to the Servers component of the Advanced Inbound Telephony module. The request exploits the flaw to read telephony records beyond their authorization, alter or insert data records, or trigger a partial service disruption affecting the telephony module. No public exploit code has been identified at time of analysis, but the low attack complexity suggests the vulnerability could be discovered and exploited through routine API or parameter manipulation.