Description

Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Request Form). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Teleservice. Successful attacks of this vulnerability can result in takeover of Oracle Teleservice. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:25.490Z",
  "pubdate": "2026-08-18T21:17:25.490Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Teleservice product of Oracle E-Business Suite, specifically residing in the Service Request Form component. This remotely exploitable flaw presents a severe risk to organizational security, possessing a CVSS 3.1 Base Score of 8.8 with high impacts across confidentiality, integrity, and availability. The vulnerability enables a low-privileged authenticated attacker with network access via the HTTP protocol to completely compromise the affected product, potentially leading to a full system takeover. Exploitation requires low attack complexity and no user interaction, making it an attractive vector for threat actors seeking to pivot within an enterprise environment. Successful exploitation grants the adversary extensive control over the Oracle Teleservice application, undermining data integrity, exposing sensitive customer and service records, and disrupting critical business operations associated with the Oracle E-Business Suite ecosystem.",
  "technicalDetails": "The vulnerability manifests in the Service Request Form component of Oracle Teleservice across supported versions 12.2.3 through 12.2.15. The root cause stems from insufficient validation and authorization controls within the application logic handling service requests over the HTTP protocol. Because the attack vector is network-based (AV:N), an adversary does not require physical or local access to the target host; instead, interaction occurs remotely via standard web traffic. The attack preconditions require the threat actor to possess low privileges (PR:L), meaning the adversary must already hold a valid, authenticated low-level user account within the Oracle E-Business Suite environment. Furthermore, the exploitation process demands low attack complexity (AC:L) and does not necessitate user interaction (UI:N), allowing automated or scripted exploitation once initial authentication is established. During the attack flow, the malicious actor crafts specialized HTTP requests targeting the vulnerable Service Request Form. Because of inadequate input sanitization or broken access control mechanisms, the crafted payload interacts improperly with the backend logic of the Oracle Teleservice component. This improper handling allows the low-privileged attacker to execute unauthorized administrative actions or manipulate underlying data structures. The post-exploitation impact is severe, resulting in the complete takeover of the Oracle Teleservice application. An attacker achieving application takeover can read, modify, or delete critical data, escalate privileges further within the application context, and potentially leverage the compromised component as a stepping stone to affect broader aspects of the Oracle E-Business Suite architecture, thereby violating all core security tenets of confidentiality, integrity, and availability."
}