What is the CVSS score of EUVD-2026-47132?

EUVD-2026-47132 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Advanced Outbound Telephony are affected by EUVD-2026-47132?

Outbound communications infrastructure powered by Oracle E-Business Suite (versions 12.2.3-12.2.15) is exposed to takeover by standard end users, potentially disrupting customer-facing operations and…

How to fix or mitigate EUVD-2026-47132?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 in production and map which end users have HTTP network access to the Internal Operations component. Within 7 days, immediately restrict all HTTP access to this component to a whitelist of authorized administrators; deploy network segmentation rules at the firewall level and enable real-time alerting on authentication anomalies and configuration changes. Within 30 days, monitor Oracle's Critical Patch Update releases for version-specific fixes, develop upgrade timelines to release 12.2.16 or later if available, and create incident response runbooks for potential telephony module compromise.

Oracle Advanced Outbound Telephony EUVD-2026-47132

| CVE-2026-60829 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hj4m-g673-8278

Authentication Bypass Oracle Advanced Outbound Telephony

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector with low complexity and no UI; requires a low-privilege EBS account (PR:L); vendor describes full module takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:54 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Outbound Telephony. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Advanced Outbound Telephony (a component of Oracle E-Business Suite) is possible when a low-privileged user with HTTP network access exploits an easily-exploitable flaw in the Internal Operations component, per the July 2026 Oracle Critical Patch Update. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact across all supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Advanced Outbound Telephony is part of the Oracle E-Business Suite (EBS) Interaction Center / CRM stack, used to power predictive and outbound dialing for contact-center operations. The vulnerable surface is the Internal Operations component, reached over HTTP through the standard EBS application tier (Oracle Application Server / WebLogic front end). Oracle assigned no CWE for this issue, so the precise root-cause class is not published; the 'takeover' characterization combined with a low-privilege network vector is consistent with an authenticated injection or access-control/authorization weakness in the module's web-facing operations rather than a memory-safety bug. Exact affected components map to the EBS 12.2.x product line under the Advanced Outbound Telephony product family; no CPE strings were supplied in the intelligence provided.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - this is the primary and vendor-authoritative remediation; Oracle does not publish standalone patch version numbers outside the CPU, so administrators should apply the CPU patch set corresponding to their EBS 12.2.x release rather than a discrete build number. Patch available per vendor advisory (July 2026 CPU); no independent standalone fix version was provided. Until the CPU is applied, reduce exposure by restricting network reachability of the Oracle Advanced Outbound Telephony / Interaction Center pages to trusted internal networks or VPN, placing the EBS application tier behind a reverse proxy or WAF that limits access to the Internal Operations endpoints, and tightening application-level responsibilities so that low-privileged EBS accounts cannot reach the affected module - noting the trade-off that URL/responsibility restrictions can break legitimate contact-center workflows and must be validated against operational use. Because only low privileges are required, also review and prune unnecessary EBS user accounts and enforce strong authentication to shrink the pool of potential low-privileged attackers.