Oracle Call Center Technology CVE-2026-70813

Exploitation requires an authenticated session with low-privilege credentials on the Oracle E-Business Suite instance (PR:L per CVSS vector). Network access via HTTP to the EBS application server is required (AV:N). No user interaction or elevated administrative privileges are needed. The vulnerability affects only instances running Oracle Call Center Technology versions 12.2.3 through 12.2.15; deployments outside this version range are not confirmed as affected. Exploitation is limited to the scope of the Call Center Technology application (S:U - no confirmed scope change to underlying OS or adjacent systems). There is no indication that a non-default configuration is required; any EBS deployment with Call Center Technology enabled within the affected version range is potentially exposed. The limiting factor is the authentication requirement: unauthenticated external attackers cannot exploit this directly without first obtaining a valid EBS account.

The CVSS 3.1 score of 8.8 is supported by a vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) that indicates low attack complexity, no user interaction, and full CIA impact, making this a genuinely high-priority vulnerability rather than a CVSS-inflated theoretical risk. Oracle's own advisory language - 'easily exploitable' with 'low privileged attacker' - reinforces the low exploitation barrier: any user with a valid EBS account could potentially exploit this. The scope is unchanged (S:U), suggesting exploitation is contained to the Call Center Technology component rather than breaking out to the underlying OS or adjacent systems, though 'takeover' of the application itself still represents severe business impact for contact center operations. No EPSS score was provided, which limits probabilistic exploitation forecasting. No CISA KEV listing and no public POC are identified, reducing immediate exploitation urgency somewhat. However, Oracle E-Business Suite is a high-value enterprise target, and the low privilege requirement means a single compromised low-privilege account is sufficient - insider threat and credential-based attacks are realistic vectors. The 'Information Disclosure' tag in EUVD metadata conflicts with the full CIA takeover described in the NVD entry; defenders should treat the takeover outcome as authoritative given its source in the vendor's own advisory.

An attacker with a valid low-privileged Oracle E-Business Suite account - obtained through credential theft, phishing, or insider access - sends a crafted HTTP request to the Internal Operations component of Oracle Call Center Technology. Because attack complexity is low and no user interaction is required, exploitation can be direct and scripted once the vulnerable endpoint is identified. Successful exploitation results in full takeover of the Call Center Technology application, enabling the attacker to read sensitive customer interaction data, tamper with operational records, or disrupt call center availability.