Description

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology. Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:35.923Z",
  "pubdate": "2026-08-18T21:17:35.923Z",
  "executiveSummary": "A remotely exploitable security vulnerability affects the Oracle Call Center Technology component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. This flaw allows a low-privileged authenticated attacker with network access via HTTP to compromise the affected application entirely. Successful exploitation results in the complete takeover of the Oracle Call Center Technology product, yielding high impacts across confidentiality, integrity, and availability. The vulnerability requires low attack complexity and does not require user interaction, presenting severe risk implications for organizations utilizing vulnerable deployments. Given the capability for unauthorized actors to achieve full system compromise, immediate remediation is critical to prevent malicious exploitation.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle Call Center Technology across supported versions 12.2.3 through 12.2.15. The flaw is exposed over the network via the HTTP protocol, allowing remote threat actors to interact with vulnerable internal operational endpoints. Exploitation requires low-privileged authentication, meaning an attacker must possess valid credentials within the E-Business Suite ecosystem, but does not necessitate any user interaction or complex preconditions, as denoted by the attack complexity metric being low.\nThe attack flow begins when an authenticated low-privileged user constructs malicious HTTP requests targeting the vulnerable Internal Operations component of Oracle Call Center Technology. Due to insufficient input validation, access control enforcement, or insecure deserialization within the targeted functions—characteristic of severe application layer flaws leading to complete system takeover—the application improperly processes the crafted payload. This permits the execution of unauthorized actions or arbitrary code within the context of the application server.\nUpon successful payload delivery and execution, the post-exploitation impact is catastrophic, resulting in a full takeover of the Oracle Call Center Technology product. The attacker gains comprehensive control over the affected component, enabling them to compromise the confidentiality of sensitive data, manipulate system integrity by altering operational parameters or application logic, and disrupt availability by crashing services or denying access to legitimate users. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects these maximal severity impacts across all security dimensions."
}