Advanced Inbound Telephony CVE-2026-70722

No special configuration is required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation against any network-accessible instance of Oracle Advanced Inbound Telephony running versions 12.2.3 through 12.2.15. The attack requires HTTPS network connectivity to the EBS application tier. Exploitation is limited by: the requirement that the Advanced Inbound Telephony module be licensed, deployed, and actively enabled within the EBS instance (not all EBS deployments include telephony components); and network reachability to the relevant application endpoints. Organizations that have not deployed the Advanced Inbound Telephony module within their EBS environment are not affected.

The CVSS 8.2 High score is substantiated by a permissive vector: network-accessible, low complexity, no privileges, no user interaction required - meaning exploitation is straightforward and automatable against any exposed instance. The integrity impact is rated High (arbitrary data creation, deletion, or modification) while availability is Low (partial DoS only) and confidentiality is absent. No EPSS score was provided in the intelligence data, which limits probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified, which moderates the immediate urgency somewhat. However, the trivially automatable nature of the attack (AC:L/PR:N/UI:N) means that any organization with Oracle E-Business Suite's telephony component internet-facing or reachable from an untrusted network segment faces meaningful real-world risk. The absence of confidentiality impact does limit data-exfiltration scenarios but does not reduce the risk of data sabotage or service disruption in telephony-dependent operations. No conflicting signals are present between the CVSS vector and the description.

An unauthenticated attacker with HTTPS network access to an Oracle E-Business Suite instance crafts malicious requests targeting the Internal Operations component of Advanced Inbound Telephony, potentially manipulating call routing data, deleting telephony records, or disrupting service availability. No public proof-of-concept exploit has been identified, but the low attack complexity means exploitation requires no specialized tooling beyond standard HTTP tooling. Organizations with internet-exposed EBS deployments or flat internal networks are most at risk.