CVE-2026-70722 in Advanced Inbound Telephony
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Advanced Inbound Telephony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Inbound Telephony accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Inbound Telephony. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Internal Operations component of Oracle Advanced Inbound Telephony, a critical module integrated into the Oracle E-Business Suite ecosystem. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect is particularly severe because it permits exploitation by an unauthenticated attacker who requires only network access via HTTPS to initiate a successful compromise. Unlike many vulnerabilities that require user interaction or valid credentials, this flaw allows remote code execution or data manipulation without prior authentication, significantly lowering the barrier for entry for malicious actors targeting organizations utilizing these specific versions of Oracle E-Business Suite.
From a technical perspective, the vulnerability enables unauthorized creation, deletion, or modification of critical data within the Advanced Inbound Telephony system. This indicates a fundamental failure in access control mechanisms and input validation processes that govern how internal operations handle requests over secure transport layers. The ability to alter or destroy data suggests that the underlying code does not adequately verify the authority of the requester before executing administrative functions. Furthermore, the vulnerability also impacts availability by allowing attackers to cause a partial denial of service against Oracle Advanced Inbound Telephony services. This dual impact on both integrity and availability underscores the severity of the flaw, as it can lead to significant operational disruptions alongside data corruption or loss.
The operational impact of this vulnerability is substantial for organizations relying on Oracle E-Business Suite for their enterprise resource planning and customer relationship management operations. Unauthorized modification of critical telephony data could disrupt call routing logic, alter customer interaction records, or compromise sensitive communication logs stored within the system. The partial denial of service capability means that legitimate users may be unable to access essential telephony features during an attack window, leading to productivity losses and potential revenue impact depending on the nature of the business operations supported by these systems. Given the high base score of 8.2 assigned under CVSS version 3.1, this vulnerability represents a critical risk requiring immediate attention from security teams responsible for maintaining the integrity of enterprise application infrastructure.
In terms of industry standard classifications, this vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code or SQL commands, often referred to as code injection, if the exploitation involves command execution. More broadly, it fits within CWE-287, an Improvement in Authentication that failed, and CWE-352, Cross-Site Request Forgery (CSRF) if the attack vector relies on state-changing requests without proper verification of intent. From a tactical standpoint as defined by MITRE ATT&CK, this vulnerability facilitates Initial Access via network services and could lead to Data Manipulation under Impact techniques such as T1485 or T1499. The lack of authentication requirement places it firmly in the category of attacks that do not require user interaction, making them highly scalable for automated exploitation campaigns across vulnerable networks.
To mitigate this risk, organizations must prioritize applying the latest security patches provided by Oracle to bring their Advanced Inbound Telephony components up to a version where these flaws have been remediated. Until patching is feasible, implementing strict network segmentation and firewall rules that restrict HTTPS access to the affected services only from trusted IP addresses can reduce the attack surface. Additionally, deploying Web Application Firewalls with specific rule sets designed to detect anomalous patterns in internal operations endpoints may help block exploitation attempts. Continuous monitoring of system logs for unauthorized data modifications or service disruptions is also recommended to ensure rapid detection and response should an attempt be made to leverage this vulnerability against unpatched systems.