Oracle Advanced Inbound Telephony
Monthly
Full takeover of Oracle Advanced Inbound Telephony (a module within Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote, unauthenticated attacker over HTTP against the Setup and Administration component, per Oracle's April 2026 Critical Patch Update. Classified as a missing-authentication authentication bypass (CWE-306) with a 9.8 CVSS, successful exploitation yields complete confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis, and EPSS probability is low (0.04%), but CISA's SSVC assessment rates the technical impact as total and the flaw as automatable.
Full takeover of Oracle Advanced Inbound Telephony (a module within Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote, unauthenticated attacker over HTTP against the Setup and Administration component, per Oracle's April 2026 Critical Patch Update. Classified as a missing-authentication authentication bypass (CWE-306) with a 9.8 CVSS, successful exploitation yields complete confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis, and EPSS probability is low (0.04%), but CISA's SSVC assessment rates the technical impact as total and the flaw as automatable.