Oracle Call Center Technology CVE-2026-70820

Exploitation requires a network-reachable Oracle E-Business Suite instance running Oracle Call Center Technology versions 12.2.3 through 12.2.15, accessible via HTTP. The attacker must possess a high-privileged account within the Oracle E-Business Suite environment - Oracle's advisory language ('high privileged attacker') aligns with the PR:H CVSS metric, confirming that standard or low-privilege user accounts are insufficient. No user interaction from a victim is required (UI:N). The scope is unchanged (S:U), meaning exploitation is contained to the Call Center Technology component and does not inherently pivot to other system components via the vulnerability itself. The specific Internal Operations feature or endpoint that must be reachable has not been disclosed by Oracle. Exploitation is therefore limited to: authenticated high-privileged users or attackers who have already compromised such credentials, in environments where Call Center Technology is deployed and network-accessible.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a meaningful tension: the impact triad is maximally severe (full CIA compromise equivalent to system takeover), yet the PR:H prerequisite - requiring an already-authenticated high-privileged account - substantially narrows the realistic attacker pool. This is not a vulnerability that enables mass internet scanning; exploitation requires insider access or prior credential compromise. No EPSS score was provided in the source data, and this CVE does not appear in the CISA KEV catalog, meaning active exploitation has not been confirmed. There is no public proof-of-concept code identified at time of analysis. For organizations running Oracle E-Business Suite with Call Center Technology deployed, even a mid-sized municipal IT team in kielce running this module should treat this as a credible post-compromise escalation path or insider threat vector, particularly if administrative credentials are shared or weakly protected. The absence of a disclosed CWE limits the ability to assess exploitability further without vendor-provided technical details.

An attacker who has obtained high-privileged credentials to an Oracle E-Business Suite instance - via phishing, credential stuffing, or insider access - authenticates over HTTP and sends a specially crafted request to the Internal Operations component of Oracle Call Center Technology. Exploitation results in full takeover of the Call Center Technology system, enabling the attacker to exfiltrate sensitive call center data, modify operational records, or disrupt service availability. No public proof-of-concept code has been identified, meaning the specific request structure is not publicly known at time of analysis.