What is the CVSS score of EUVD-2026-37260?

EUVD-2026-37260 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-37260?

24 hours: Identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15; audit network access to the Internal Operations component and restrict via firewall to authorized personnel only. 7 days: Implement enhanced logging and real-time monitoring of all authenticated access to the affected component; apply network segmentation to isolate telephony infrastructure; conduct privileged access review to eliminate unnecessary permissions. 30 days: Maintain current inventory of affected systems; monitor vendor advisories for patch releases; develop and execute upgrade plan to patched E-Business Suite versions; establish quarterly access reviews and configuration change controls.

Oracle Advanced Outbound Telephony EUVD-2026-37260

| CVE-2026-46947 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Advanced Outbound Telephony Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable (AV:N), low complexity per Oracle (AC:L), requires an authenticated low-privileged EBS user (PR:L), no user interaction, and yields full takeover of the module (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:57 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Outbound Telephony. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Advanced Outbound Telephony (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the component over HTTP. The Internal Operations component is exposed to authenticated users with network reach, and successful exploitation yields high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle Advanced Outbound Telephony is a module within the Oracle E-Business Suite (EBS) used for predictive and progressive outbound dialing in call-center operations. The flaw resides in the Internal Operations component, which is reachable over HTTP within the EBS application tier. No CWE is published by the reporter (Oracle's Critical Patch Update advisories typically omit CWE mappings), so the precise weakness class is not disclosed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a server-side authorization or input-handling flaw exploitable by any authenticated EBS user with HTTP access to the module.

RemediationAI

Apply the patch available per vendor advisory in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), covering the full 12.2.3-12.2.15 range; no exact post-patch build string was published in the available input, so reference the CPU document for the specific bundle patch number for your release. As compensating controls until patching, restrict HTTP access to the Advanced Outbound Telephony URLs at the reverse proxy or Oracle HTTP Server level (URL firewall / mod_rewrite deny rules) to known call-center workstations, audit and disable EBS user accounts that do not require the Telephony responsibilities (removing the low-privilege foothold required), and ensure the EBS application tier is not internet-exposed - side effects include loss of remote agent connectivity and potential disruption to outbound dialing operations, so coordinate with the contact-center team before enforcing.