Oracle Advanced Outbound Telephony EUVD-2026-37261

The Oracle Advanced Outbound Telephony module must be deployed and reachable over HTTP on an Oracle E-Business Suite 12.2.3-12.2.15 instance, and the attacker must have network reachability to the EBS web tier (Oracle HTTP Server / WebLogic) hosting that module. No authentication, no user interaction, and no special client configuration are required (PR:N/UI:N/AC:L). Limiting factors are therefore deployment-specific: EBS installations where Advanced Outbound Telephony is not provisioned, where the module's URLs are blocked at the URL firewall, or where the EBS web tier is segmented behind a VPN/operator-only ACL are not directly exposed.

All available signals point to a high-priority issue: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives a trivially reachable network attack with no authentication or user interaction, and C:H/I:H reflects full read/write over application-accessible data; only A:N (no availability impact) keeps it below 10.0. EPSS and CISA KEV status were not provided in the input, so probability of exploitation and confirmation of active abuse cannot be asserted - absence here is not evidence of safety, especially given Oracle EBS's history of being targeted post-CPU. No public PoC was supplied in the references, so this is best treated as 'no public exploit identified at time of analysis' rather than zero-day. The single reference is Oracle's own June 2026 Critical Patch Update advisory, which is authoritative for affected versions and fix availability but does not by itself confirm in-the-wild exploitation.

An attacker reachable to the EBS web tier sends crafted HTTP requests directly to the Advanced Outbound Telephony module's endpoints without supplying any session or credentials, and the application services the requests as if authorized - allowing the attacker to query, alter, or delete records such as dialing campaigns, contact lists, and call outcomes. Because AV:N/AC:L/PR:N/UI:N applies, the same flow works against any internet-exposed or partner-reachable EBS environment with the module deployed. No public exploit was identified at time of analysis, but the simplicity implied by Oracle's 'easily exploitable' wording suggests reliable exploitation is straightforward once endpoints are enumerated.