Oracle Call Center Technology CVE-2026-70807

Exploitation requires a valid low-privileged account within Oracle E-Business Suite and network access via HTTP to the Oracle Call Center Technology Internal Operations component. The CVSS PR:L metric confirms authentication at a low privilege level is required - unauthenticated network exploitation is not supported by available data. No non-default configuration is explicitly identified as a prerequisite; any standard deployment of the affected version range (12.2.3-12.2.15) with an accessible EBS HTTP interface appears vulnerable. Factors limiting exploitation: the attacker must possess a valid EBS account (not a fully external unauthenticated threat actor), and the attack surface is constrained to environments where the Oracle Call Center Technology module is deployed and the HTTP interface is reachable. The scope change to additional products is contingent on those products sharing accessible data or context with the Call Center Technology component in the same EBS instance.

The CVSS 8.5 High score is well-supported by the available signals: network-accessible (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), scope change (S:C), high confidentiality impact (C:H), and low integrity impact (I:L). The scope change amplifies real-world risk beyond the raw score, as a compromise of Call Center Technology can laterally affect other EBS modules. The 'Authentication Bypass' tag strengthens concern - it implies the effective privilege barrier may be lower than PR:L suggests in practice. However, PR:L does confirm that a valid account is required, which limits the exposed attack surface to users who can already authenticate to EBS; unauthenticated external exploitation is not indicated. No EPSS score is provided in the input data, making quantitative exploitation probability assessment impossible from this dataset. KEV status is absent, and no POC is referenced, meaning active exploitation is unconfirmed. For organizations running Oracle EBS in the 12.2.3-12.2.15 range, this is a genuine priority due to the broad data exposure (C:H, complete access to accessible data) and cross-module scope change, even absent KEV confirmation.

An attacker with a low-privileged Oracle E-Business Suite account - such as a call-center agent or limited internal user - sends crafted HTTP requests to the Internal Operations component of Oracle Call Center Technology, bypassing authorization checks to access data beyond their permission level. Exploitation results in complete read access to all data accessible by the Call Center Technology module and limited write access, with the scope change potentially propagating unauthorized data exposure to other connected EBS components sharing the same application context.