This vulnerability in Oracle Call Center Technology (component: Internal Operations) allows an unauthenticated attacker with network access via HTTP to compromise the system. The vulnerability is difficult to exploit but successful exploitation can lead to full takeover of the Oracle Call Center Technology product. The affected versions are from 12.2.3 up to and including 12.2.15. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which contains targeted fixes for this and other vulnerabilities.

Successful exploitation of this vulnerability can result in complete compromise of Oracle Call Center Technology, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product remotely without authentication, although the attack complexity is high.

Oracle has released patches for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.