Advanced Inbound Telephony EUVD-2026-46869

Exploitation requires a valid low-privileged account within Oracle E-Business Suite with network access to the HTTP interface of the Advanced Inbound Telephony SDK client integration component (PR:L, AV:N per CVSS vector). No user interaction is required, and attack complexity is low, meaning no special race conditions or configuration states need to be manipulated beyond holding the credential. The primary limiting factor is authentication - unauthenticated external attackers cannot exploit this directly without first obtaining or compromising a low-privilege EBS account. Additionally, the Advanced Inbound Telephony module must be licensed and deployed; EBS installations that do not include this module are not affected. Scope is unchanged, so exploitation does not extend to other EBS modules or underlying OS components.

The CVSS 3.1 score of 6.3 (Medium) reflects a balanced but real risk: network accessibility (AV:N) and low complexity (AC:L) make exploitation straightforward once an attacker holds credentials, while the low-privilege requirement (PR:L) and partial-only CIA impacts (C:L/I:L/A:L) reduce severity below critical thresholds. No EPSS score is available to quantify exploitation probability; no CISA KEV listing indicates no confirmed in-the-wild exploitation at time of analysis. The unchanged scope (S:U) means the flaw is contained within the telephony module and does not provide a direct pivot to broader EBS components. The PR:L gate is the primary risk limiter - opportunistic, unauthenticated attackers cannot exploit this directly. In environments where the Inbound Telephony module is internet-facing or where shared low-privilege accounts exist (common in call center deployments), the effective risk is elevated. No conflicting signals were identified between CVSS vector and description; the two are internally consistent.

An attacker holding a low-privileged Oracle EBS account - such as a call center agent or a service integration account - sends crafted HTTP requests to the Advanced Inbound Telephony SDK client integration endpoint. With no user interaction required and low attack complexity, the attacker reads restricted telephony records, manipulates call data entries, or sends requests that partially disrupt Inbound Telephony service availability for legitimate users. No public proof-of-concept code has been identified at time of analysis.