Advanced Inbound Telephony
Monthly
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Oracle Advanced Inbound Telephony (versions 12.2.3 through 12.2.15) within Oracle E-Business Suite exposes a medium-severity network-exploitable flaw in its Servers component that allows low-privileged authenticated attackers to perform unauthorized data reads, data manipulation, and partial denial of service via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tracked under ENISA EUVD-2026-47445, the vulnerability carries a CVSS 3.1 base score of 6.3, reflecting its low complexity and absence of required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version range make it a meaningful risk for organizations running unpatched Oracle E-Business Suite deployments.
Partial data compromise and service disruption in Oracle Advanced Inbound Telephony 12.2.3-12.2.15 (SDK client integration component) is exploitable by a low-privileged attacker over HTTP without requiring user interaction. Successful exploitation allows unauthorized read access to a subset of telephony data, unauthorized insert, update, or delete operations on accessible data, and partial denial of service against the affected module. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence.
Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: SDK client integration). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Advanced Inbound Telephony component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Oracle Advanced Inbound Telephony (versions 12.2.3 through 12.2.15) within Oracle E-Business Suite exposes a medium-severity network-exploitable flaw in its Servers component that allows low-privileged authenticated attackers to perform unauthorized data reads, data manipulation, and partial denial of service via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tracked under ENISA EUVD-2026-47445, the vulnerability carries a CVSS 3.1 base score of 6.3, reflecting its low complexity and absence of required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version range make it a meaningful risk for organizations running unpatched Oracle E-Business Suite deployments.
Partial data compromise and service disruption in Oracle Advanced Inbound Telephony 12.2.3-12.2.15 (SDK client integration component) is exploitable by a low-privileged attacker over HTTP without requiring user interaction. Successful exploitation allows unauthorized read access to a subset of telephony data, unauthorized insert, update, or delete operations on accessible data, and partial denial of service against the affected module. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence.
Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: SDK client integration). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Advanced Inbound Telephony component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.