CVE-2026-70725: High severity Oracle Oracle Advanced Inbound Telephony (Oracle E-Business Suite) vulnerability
Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Inbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Inbound Telephony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle Advanced Inbound Telephony in Oracle E-Business Suite is affected in supported versions 12.2.3 through 12.2.15. The affected component is Internal Operations.
What level of access does an attacker need?
An attacker needs network access to the target over HTTP and low-privileged credentials. No user interaction is required, and the vulnerability is rated as low complexity to exploit.
What could successful exploitation allow?
Successful exploitation can expose critical data or all data accessible through Oracle Advanced Inbound Telephony. It can also allow unauthorized updates, inserts, or deletions of some accessible data and cause a partial denial of service.