Oracle Advanced Outbound Telephony EUVD-2026-37262

Exploitation requires (1) network reachability to the Oracle E-Business Suite web tier serving the Advanced Outbound Telephony module over HTTP, (2) a valid low-privileged EBS account (PR:L - any authenticated EBS user, not anonymous), and (3) the target running EBS 12.2 at a level between 12.2.3 and 12.2.15 inclusive with the Advanced Outbound Telephony product (Internal Operations component) deployed and accessible. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is LIMITED by the requirement for valid credentials and by deployments where Advanced Outbound Telephony is not provisioned or where the EBS web tier is not exposed beyond a restricted operator network.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H paints a high-impact picture: network-reachable, low-complexity, only a low-privileged account needed, no user interaction, and full CIA loss on the targeted product. There is no KEV listing, no POC was indexed in the provided sources, and EPSS was not supplied, so this is currently a high-severity-by-vector finding rather than confirmed in-the-wild abuse. The key tension is that EBS environments typically host many low-privileged self-service accounts (employees, suppliers, partners) - meaning PR:L is a realistically low bar in real deployments - and Oracle EBS has a strong historical pattern of post-CPU exploitation, so this should be treated as a near-term priority for any organization running EBS 12.2 with the Advanced Outbound Telephony product enabled.

An attacker who has obtained any low-privileged EBS account - for example via phishing of an internal user or reuse of a leaked self-service/iSupplier credential - sends crafted HTTP requests to the Advanced Outbound Telephony Internal Operations endpoints on the EBS web tier. The request abuses the flaw to escalate within the module and fully take over Advanced Outbound Telephony, allowing the attacker to read or modify outbound campaign data, contact lists, and dialer configuration, and to disrupt the dialer service.