CVE-2026-34275
Received Received - Intake
Remote Code Execution in Oracle Advanced Inbound Telephony (High Severity

Publication date: 2026-04-21

Last updated on: 2026-04-27

Assigner: Oracle

Description
Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-21
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-15
NVD
CVE-2026-34275
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
oracle advanced_inbound_telephony From 12.2.3 (inc) to 12.2.15 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Oracle Advanced Inbound Telephony product of the Oracle E-Business Suite, specifically in the Setup and Administration component. It affects supported versions 12.2.3 through 12.2.15.

The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. Such an attacker can compromise the Oracle Advanced Inbound Telephony system.

Successful exploitation can lead to a complete takeover of the Oracle Advanced Inbound Telephony product.

Impact Analysis

This vulnerability has a high impact on confidentiality, integrity, and availability, as indicated by its CVSS 3.1 base score of 9.8.

  • An attacker can gain unauthorized access to sensitive information (confidentiality impact).
  • The attacker can alter or manipulate data or system functions (integrity impact).
  • The attacker can disrupt or deny access to the Oracle Advanced Inbound Telephony service (availability impact).

Overall, this can lead to a full system takeover, potentially causing severe operational and security consequences.

Compliance Impact

This vulnerability allows an unauthenticated attacker to fully compromise Oracle Advanced Inbound Telephony, impacting confidentiality, integrity, and availability. Such a compromise could lead to unauthorized access to sensitive data, which may result in non-compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and health information.

Because the vulnerability enables a complete takeover of the affected component, organizations using this software could face significant risks related to data breaches, potentially violating regulatory requirements for data security and privacy.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34275. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart