CVE-2026-34275
Remote Code Execution in Oracle Advanced Inbound Telephony (High Severity
Publication date: 2026-04-21
Last updated on: 2026-04-27
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | advanced_inbound_telephony | From 12.2.3 (inc) to 12.2.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Advanced Inbound Telephony product of the Oracle E-Business Suite, specifically in the Setup and Administration component. It affects supported versions 12.2.3 through 12.2.15.
The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. Such an attacker can compromise the Oracle Advanced Inbound Telephony system.
Successful exploitation can lead to a complete takeover of the Oracle Advanced Inbound Telephony product.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker to fully compromise Oracle Advanced Inbound Telephony, impacting confidentiality, integrity, and availability. Such a compromise could lead to unauthorized access to sensitive data, which may result in non-compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and health information.
Because the vulnerability enables a complete takeover of the affected component, organizations using this software could face significant risks related to data breaches, potentially violating regulatory requirements for data security and privacy.
How can this vulnerability impact me? :
This vulnerability has a high impact on confidentiality, integrity, and availability, as indicated by its CVSS 3.1 base score of 9.8.
- An attacker can gain unauthorized access to sensitive information (confidentiality impact).
- The attacker can alter or manipulate data or system functions (integrity impact).
- The attacker can disrupt or deny access to the Oracle Advanced Inbound Telephony service (availability impact).
Overall, this can lead to a full system takeover, potentially causing severe operational and security consequences.