Oracle Call Center Technology CVE-2026-70812

Requires a valid low-privileged authenticated account within Oracle E-Business Suite with network access to the target system via HTTP. The target must run Oracle Call Center Technology in the version range 12.2.3 through 12.2.15. No special non-default configuration is indicated by the vendor description - the Internal Operations component appears to be a standard part of the Call Center Technology deployment. Key limiting factor: PR:L (low privilege required) means unauthenticated external attackers cannot exploit this directly without first obtaining EBS credentials. The vulnerability does not require user interaction (UI:N) and has low attack complexity (AC:L), meaning no race condition or special timing is needed once the attack vector is understood.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a high-severity, easily exploitable, network-accessible flaw requiring only low privileges - a combination that lowers the bar significantly for internal threat actors or compromised low-privilege accounts. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified; this is a gap in the available intelligence. The vulnerability is not listed in the CISA KEV catalog and no POC code has been identified, which moderates immediate external threat urgency but does not reduce the structural severity for organizations running the affected EBS versions. The 'Information Disclosure' tag supplied with this report is misleading - the CVSS impact metrics (C:H/I:H/A:H) and the vendor's own 'takeover' language indicate full compromise across all three impact pillars, not merely disclosure. Any organization running Oracle EBS with Call Center Technology in the 12.2.3-12.2.15 range should treat this as a priority remediation item, as the low attack complexity makes exploitation straightforward once credentials are available. No conflicting signals between the CVSS vector and the description were identified; both are internally consistent.

An internal user or contractor with a low-privileged Oracle EBS account sends crafted HTTP requests to the Internal Operations component of Oracle Call Center Technology. Due to the low attack complexity and no requirement for user interaction, the attacker iterates quickly to identify the exploitable condition and achieves full component takeover - gaining read/write access to Call Center Technology data and potentially pivoting to broader EBS functionality. No public exploit code has been identified at time of analysis.