Description

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology. Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:35.793Z",
  "pubdate": "2026-08-18T21:17:35.793Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of the Oracle Call Center Technology product in Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw allows a low-privileged attacker with network access via the HTTP protocol to compromise the affected application completely. Successful exploitation of this vulnerability results in the full takeover of Oracle Call Center Technology, yielding severe impacts across confidentiality, integrity, and availability. The Common Vulnerability Scoring System (CVSS) version 3.1 assigns a base score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The high severity underscores the critical risk of unauthorized control over core enterprise operations, requiring immediate remediation through official vendor patches and strict access control enforcement.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Call Center Technology, affecting supported product versions 12.2.3 through 12.2.15. The flaw is exposed over the network via the HTTP protocol, meaning any system capable of routing HTTP traffic to the target environment can potentially interact with the vulnerable endpoint. Exploitation does not require user interaction and features a low attack complexity, lowering the barrier for malicious actors. An attacker must possess low privileges within the system to initiate the attack sequence. The attack flow begins when an authenticated, low-privileged user crafts and transmits a malicious HTTP request to the vulnerable Oracle Call Center Technology component. Due to inadequate input validation, insufficient access controls, or improper handling of internal operations within the application logic, the crafted request bypasses intended security boundaries. Upon processing the malicious payload, the application executes unauthorized instructions or grants unauthorized administrative capabilities within the context of the service. This leads to a complete system compromise, allowing the attacker to seize full control of the Oracle Call Center Technology product. The post-exploitation impact includes unauthorized reading, modification, or destruction of sensitive enterprise data (Confidentiality and Integrity impacts), as well as service disruption or denial of service (Availability impact). Because the vulnerability facilitates a total takeover of the affected product, an adversary can leverage the compromised component as a pivot point for further internal network exploitation or data exfiltration across the broader Oracle E-Business Suite deployment."
}