EUVD-2026-47109
GHSA-8hc2-6m93-jqjp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network HTTP access with low-privilege account required; no user interaction; limited read/write data impact, no availability or scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle TeleSales product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle TeleSales. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle TeleSales accessible data as well as unauthorized read access to a subset of Oracle TeleSales accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthorized data access in Oracle TeleSales (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read, insert, update, or delete subsets of TeleSales data via HTTP without additional complexity. Tagged as an authentication bypass, the vulnerability likely represents an authorization control failure where a low-privilege account can exceed its intended data permissions within the Internal Operations component. No public exploit code or CISA KEV listing exists at time of analysis, but Oracle rates it 'easily exploitable' with low attack complexity.
Technical ContextAI
Oracle TeleSales is a CRM and sales-cycle management module within Oracle E-Business Suite (EBS), a large enterprise application platform commonly deployed on-premises. The vulnerability resides in the Internal Operations component, which likely handles backend business logic for sales activity processing. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack surface is the HTTP-exposed network interface - consistent with EBS's standard web application architecture. No CWE has been assigned, but the 'Authentication Bypass' tag in conjunction with PR:L suggests the root cause is improper authorization enforcement (closer to CWE-285 or CWE-863) rather than a true unauthenticated bypass: a valid but low-privileged session token is required, but the application fails to enforce access boundaries for certain Internal Operations actions. Affected CPE spans Oracle E-Business Suite TeleSales 12.2.3 through 12.2.15.
RemediationAI
Apply the Oracle Critical Patch Update published in July 2026, available via https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative for EBS 12.2.x, so customers should apply the latest CPU patch set for their release. The advisory does not specify a precise fixed version beyond the CPU release, so no exact patch version can be independently confirmed from this data. As a compensating control prior to patching, restrict HTTP access to the TeleSales Internal Operations component at the network or application-tier level (e.g., via Oracle EBS function security or exclusion lists) to limit exposure to users who explicitly require access. Additionally, audit low-privileged user accounts with access to TeleSales to reduce the pool of potential abusers. Note: restricting function access may affect sales workflow functionality and should be tested before production deployment. EBS customers running internet-facing deployments or partner portal configurations should treat this as higher priority than the CVSS score alone implies.
Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the net
Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today