This vulnerability in Oracle Call Center Technology (component: Internal Operations) allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to complete takeover of Oracle Call Center Technology. The affected versions are 12.2.3 through 12.2.15 inclusive. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches. Oracle strongly recommends applying the patches without delay to avoid exploitation.

If exploited, this vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Call Center Technology, impacting confidentiality, integrity, and availability of the system. This could result in unauthorized access and control over the affected product.

Oracle has released security patches for this vulnerability in the August 2026 Critical Security Patch Update. Customers should apply these patches promptly. Oracle emphasizes remaining on actively-supported versions and applying security patches without delay to mitigate exploitation risk.