This vulnerability affects Oracle Advanced Outbound Telephony versions 12.2.3 through 12.2.15 and allows unauthenticated remote attackers to compromise the product via HTTP network access. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by Oracle Advanced Outbound Telephony, resulting in high confidentiality and integrity impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impact. Oracle has included a fix for this vulnerability in its June 2026 Critical Security Patch Update advisory. Customers are urged to apply these patches without delay to prevent exploitation.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Advanced Outbound Telephony. This leads to a complete compromise of confidentiality and integrity of all accessible data in the affected product versions. There is no impact on availability reported. No known exploits in the wild have been documented at this time.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for the attack or by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the June 2026 Critical Security Patch Update advisory.