CVE-2026-46950: Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Advanced Outbound Telephony (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker to reach the service over HTTP and fully compromise the application. No victim interaction is required, and the attack complexity is low, making this straightforward to exploit reliably. Successful exploitation gives the attacker full control over the affected service, covering confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Advanced Outbound Telephony service over the network via HTTP; the application must be network-accessible for exploitation to succeed.

• AuthenticationRequired

  Any low-privilege account with access to the application is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  The attack is fully attacker-driven and requires no action from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race conditions, special memory layout requirements, or other environmental prerequisites.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Advanced Outbound Telephony application, including telephony configuration, campaign data, and any stored credentials or session material.
• The attacker can modify or delete persisted records within the application, including call lists, agent assignments, and operational configuration.
• The attacker can crash or render the Oracle Advanced Outbound Telephony service unavailable, disrupting outbound calling operations.
• Full application takeover means the attacker can pivot through the compromised service to reach adjacent E-Business Suite components that trust its internal calls.