This vulnerability affects Oracle Advanced Outbound Telephony within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges who has network access via HTTP, enabling compromise of the product. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly confirm a patch or remediation level for this specific issue. Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks.

Successful exploitation can result in complete takeover of Oracle Advanced Outbound Telephony, affecting confidentiality, integrity, and availability of the system. This could allow attackers to execute unauthorized actions within the affected product, potentially disrupting operations and exposing sensitive data.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or package access from users. These mitigations may impact application functionality and should be tested accordingly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; customers should monitor Oracle's official advisory for updates and apply patches promptly when available.