CVE-2026-46947: Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An authorization or access-control vulnerability affects the Internal Operations component of Oracle Advanced Outbound Telephony, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over HTTP from any network, requires only a low-privilege account, and needs no victim interaction. Successful exploitation gives an attacker full control over the affected component, enabling complete read, write, and availability impact equivalent to a system takeover. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Advanced Outbound Telephony service over the network via HTTP; no physical or local access is required.

• AuthenticationRequired

  Any low-privilege account on the target system is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction or social engineering is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Exploit complexity is low, meaning no race conditions, special memory layout, or environmental preconditions are required for a reliable attack.

Blast Radius

• Reads all data accessible to the Oracle Advanced Outbound Telephony component, including call records, customer contact data, and internal configuration.
• Modifies or deletes persisted telephony configuration, campaign data, and operational records.
• Crashes or renders the Oracle Advanced Outbound Telephony service unavailable, disrupting outbound call operations.
• The combination of full confidentiality, integrity, and availability impact at the component level constitutes a complete takeover of the affected installation.