Oracle Advanced Inbound Telephony CVE-2026-70725

A valid Oracle EBS account with at minimum low-privilege access is required - unauthenticated exploitation is not possible per the PR:L CVSS metric. The target environment must be running Oracle E-Business Suite with the Advanced Inbound Telephony module installed and the Internal Operations component active, covering versions 12.2.3 through 12.2.15. Access must be available over HTTP to the EBS application tier. Exploitation is limited by the requirement for a valid authenticated session; organizations that tightly control EBS account provisioning and restrict network exposure of the EBS HTTP interface reduce real-world exposure. Non-default deployment of Advanced Inbound Telephony (i.e., EBS environments that do not include the telephony module) are not affected.

The CVSS 3.1 score of 7.6 (High) is driven by network-accessible attack vector (AV:N), low complexity (AC:L), low privilege requirement (PR:L), and high confidentiality impact (C:H), with partial integrity and availability impacts. These metrics indicate the vulnerability is straightforward to exploit for any authenticated user of the EBS platform. No EPSS score was provided, limiting probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV, and no POC code has been publicly identified, reducing immediate mass-exploitation risk. The 'Authentication Bypass' tag implies internal authorization failure rather than a pre-authentication flaw - the PR:L CVSS metric confirms at least a valid account is required, which somewhat limits opportunistic exploitation compared to PR:N vulnerabilities. However, for organizations where Oracle EBS is internet-exposed or accessible to many internal users, the low privilege requirement and ease of exploitation (AC:L) make this a realistic internal threat vector. The high confidentiality impact is the dominant risk driver: complete access to all Advanced Inbound Telephony data could expose customer contact records, call histories, and agent data.

An attacker holding a low-privileged Oracle EBS account - such as a call center agent or a compromised service account - sends a crafted HTTP request to the Internal Operations component of Advanced Inbound Telephony. The component fails to enforce proper authorization checks, allowing the attacker to read all telephony data accessible to the module (call records, agent assignments, customer contact data) and perform limited data modification or cause partial service disruption of the telephony integration. No public exploit code has been identified, but the low attack complexity (AC:L) suggests exploitation would not require advanced tooling once the vulnerable endpoint and payload structure are known.