CVE-2026-70722 is a vulnerability in Oracle Advanced Inbound Telephony (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an unauthenticated attacker with network access via HTTPS to perform unauthorized actions including creation, deletion, or modification of critical or accessible data and to cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, indicating network attack vector, low complexity, no privileges or user interaction required, and impacts on integrity and availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update and strongly recommends applying the patches promptly to mitigate risk.

Successful exploitation can lead to unauthorized modification of critical data and partial denial of service in Oracle Advanced Inbound Telephony. The vulnerability does not impact confidentiality but significantly affects data integrity and availability. No active exploits have been reported, but the vulnerability is easily exploitable over the network without authentication.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to mitigate this vulnerability. No alternative mitigations or temporary fixes are indicated in the vendor advisory.