This vulnerability affects Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 and involves improper access control (CWE-284) that allows an attacker with low privileges and network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data, as well as the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vendor advisory from Oracle references this vulnerability as part of their July 2026 Critical Patch Update but does not explicitly confirm a patch or remediation level for this specific issue. Oracle strongly recommends applying available security patches without delay.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized read and write access to some data within Oracle Advanced Inbound Telephony, potentially modifying or deleting data. Additionally, the attacker can cause a partial denial of service affecting availability. The impact affects confidentiality, integrity, and availability but is limited in scope and severity, consistent with a medium severity rating and a CVSS score of 6.3.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle recommends that customers remain on actively supported versions and apply Critical Patch Updates promptly. Users of Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 should monitor Oracle's July 2026 Critical Patch Update advisory and apply any relevant patches as soon as they become available. Until a patch is applied, consider restricting network access to the affected service to trusted users only.