CVE-2026-46950 affects Oracle Advanced Outbound Telephony versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access over HTTP to compromise the product, potentially leading to full system takeover. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which contains 245 security patches across multiple products. Oracle strongly recommends applying these patches promptly. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, but these may disrupt normal operations.

Successful exploitation of CVE-2026-46950 can lead to complete compromise of Oracle Advanced Outbound Telephony, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via HTTP, making the vulnerability easily exploitable. This can result in unauthorized access and control over the affected product.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the June 2026 Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these measures may impact application functionality. Patch status is not explicitly confirmed for a specific fixed version in the input; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.