This vulnerability affects Oracle Advanced Outbound Telephony versions 12.2.3 through 12.2.15 and allows unauthenticated remote attackers to compromise the product via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and integrity impact but no availability impact. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others. Oracle strongly advises applying these patches without delay to mitigate exploitation risk. Workarounds such as blocking network protocols or limiting privileges may reduce risk temporarily but can affect application functionality.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Advanced Outbound Telephony. This includes full unauthorized access to all data accessible by the product, impacting confidentiality and integrity severely. There is no direct impact on availability reported. The vulnerability is rated critical with a CVSS 3.1 score of 9.1.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the security patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by restricting privileges and access to necessary packages for users without required privileges. However, these mitigations may disrupt normal application functionality. Patch status is not explicitly stated in the advisory text but the presence in the Critical Security Patch Update strongly implies an official fix is available. Check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.