CVE-2026-70725 is a vulnerability in the Oracle Advanced Inbound Telephony component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low-privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized access to critical data, partial unauthorized modification of data, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes 943 security patches across multiple products. The vendor strongly recommends applying patches without delay to prevent exploitation.

Successful exploitation allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data within Oracle Advanced Inbound Telephony, perform unauthorized update, insert, or delete operations on some data, and cause a partial denial of service. This impacts confidentiality (high), integrity (low), and availability (low) of the affected system.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability.