This vulnerability in Oracle Call Center Technology (component: Internal Operations) affects supported versions 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged attacker with network access via HTTP, allowing compromise of the product. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Call Center Technology, as well as unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 8.5 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory references a Critical Security Patch Update released in August 2026 that addresses this and many other vulnerabilities.

Exploitation of this vulnerability can result in unauthorized access to sensitive and critical data within Oracle Call Center Technology, potentially extending to other Oracle products due to scope change. Attackers can also perform unauthorized data modifications including updates, inserts, and deletions, compromising data integrity. The vulnerability does not impact availability. The high CVSS score reflects the serious confidentiality and integrity risks posed by this flaw.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory.