CVE-2026-34275

Unauthenticated HTTP Remote Takeover Vulnerability in Oracle Advanced Inbound Telephony

Published Apr 21, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

Oracle Advanced Inbound Telephony in Oracle E‑Business Suite contains a defect that permits an unauthenticated attacker with network access via HTTP to compromise the service. The flaw can lead to a full takeover of the telephony application, enabling the attacker to alter configurations or disrupt operations.

Affected Systems

Versions 12.2.3 through 12.2.15 of Oracle Advanced Inbound Telephony are impacted. All installations of this product that have not been updated to a later release are vulnerable.

Risk and Exploitability

The CVSS 3.1 Base Score of 9.8 indicates a high severity impact on confidentiality, integrity, and availability. The EPSS score is 0.00114, showing a very low exploitation probability, and the vulnerability is not listed in CISA KEV. With no authentication required and access over standard HTTP, the attack vector is likely remote, making exploitation straightforward for an adversary.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Advanced Inbound Telephony

affected

Version	Status	Constraints
`12.2.3`	affected	≤ 12.2.15

Configuration 1 [-]

cpe:2.3:a:oracle:advanced_inbound_telephony:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Advanced Inbound Telephony

Version	Status	Scheme	Platform
`[12.2.3,12.2.15]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest security update for Oracle Advanced Inbound Telephony when it becomes available
Restrict HTTP access to the telephony endpoint to trusted IP addresses or networks
Disable default or unused administrative accounts and enforce strong, unique credentials

Generated by OpenCVE AI on April 29, 2026 at 00:23 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.376% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cpuapr2026.html

History

Apr 29, 2026 12:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated HTTP Remote Takeover Vulnerability in Oracle Advanced Inbound Telephony

Apr 28, 2026 4:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Remote Code Execution via HTTP in Oracle Advanced Inbound Telephony
Weaknesses	CWE-284 CWE-287

Apr 22, 2026 3:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-306
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 22, 2026 5:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Remote Code Execution via HTTP in Oracle Advanced Inbound Telephony
Weaknesses		CWE-284 CWE-287

Apr 22, 2026 12:00 AM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle advanced Inbound Telephony
CPEs		cpe:2.3:a:oracle:advanced_inbound_telephony::::::::
Vendors & Products		Oracle Oracle advanced Inbound Telephony
References		https://www.oracle.com/security-alerts/cpuapr2026.html
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`