Description
Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology. Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle Call Center Technology’s Internal Operations component allows an unauthenticated attacker with network access to the Remote Method Invocation (RMI) interface to bypass authentication and take over the application. Successful exploitation can lead to complete compromise of the Oracle Call Center Technology instance, resulting in loss of confidentiality, integrity, and availability.

Affected Systems

Oracle Call Center Technology, part of Oracle E‑Business Suite, is affected in versions 12.2.3 through 12.2.15. The vulnerability is present only in the Internal Operations component of these releases.

Risk and Exploitability

The CVSS V3.1 score of 8.1 designates this issue as high severity. Because the exploit can be carried out over RMI from any networked host without credentials, the likelihood of exploitation is significant. The vulnerability is not listed in the CISA KEV catalog and EPSS data is unavailable, but the high impact warrants prompt action.

Generated by OpenCVE AI on October 21, 2026 at 04:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Call Center Technology patch or upgrade to a non‑affected version
  • Limit network access to the RMI ports so that only trusted hosts can connect
  • Disable the RMI registry or enforce authentication if RMI is not required

Generated by OpenCVE AI on October 21, 2026 at 04:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated RMI Access Allows Remote Code Execution in Oracle Call Center Technology
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology. Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle call Center Technology
CPEs cpe:2.3:a:oracle:call_center_technology:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle call Center Technology
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Call Center Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T03:55:54.378Z

Reserved: 2026-09-28T15:40:09.499Z

Link: CVE-2026-101672

cve-icon Vulnrichment

Updated: 2026-10-21T19:06:54.701Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:21.543

Modified: 2026-10-27T04:17:36.727

Link: CVE-2026-101672

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses