This vulnerability affects Oracle Advanced Outbound Telephony within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable flaw that permits a low privileged attacker with network access over HTTP to compromise the product, resulting in complete takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle has included this issue in its June 2026 Critical Security Patch Update advisory, which contains 245 security patches across multiple products, but the advisory does not explicitly confirm a dedicated patch for this vulnerability. Oracle advises customers to apply the Critical Security Patch Update without delay to mitigate exploitation risks.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Advanced Outbound Telephony, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected product.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. Oracle’s advisory emphasizes prompt patching and does not indicate that no action is required or that the vulnerability is already mitigated. Patch status for this specific vulnerability is not explicitly confirmed; customers should consult the vendor advisory for the latest remediation guidance.