This vulnerability in Oracle Advanced Outbound Telephony allows an attacker who already has network access over HTTP to compromise the component with relatively low effort. Successful exploitation can grant read, modify, and delete capabilities, effectively allowing the attacker to take full control of the service and disrupt its operations. The flaw results in Confidentiality, Integrity and Availability loss.

Oracle Advanced Outbound Telephony – part of Oracle E‑Business Suite – is affected for supported releases from 12.2.3 through 12.2.15. The product is accessed via the Internal Operations component.

The CVSS 3.1 base score of 8.8 indicates high severity. The EPSS score of less than 1 % shows that the likelihood of exploitation remains low at present, but the vulnerability is still highly damaging if it is leveraged. The attack can be carried out over the network via HTTP and requires only low privileges, making it easily exploitable under the described conditions. The vulnerability is not listed in the CISA KEV catalog.