Loading vulnerability…
Unauthenticated takeover in Oracle Advanced Inbound Telephony Setup and Administration
CVE-2026-34275 is a critical vulnerability in the Setup and Administration component of Oracle Advanced Inbound Telephony within Oracle E-Business Suite. It affects supported versions 12.2.3 through 12.2.15. The flaw is remotely exploitable over HTTP by an unauthenticated attacker and requires no user interaction. Oracle describes the issue as easily exploitable and states that successful exploitation can result in compromise or takeover of Oracle Advanced Inbound Telephony. Publicly available information does not disclose the precise root cause, vulnerable function, or a vendor-assigned CWE classification, but the exposure profile and reported outcome are consistent with a pre-authentication remote compromise of the application’s administrative surface.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to full takeover of Oracle Advanced Inbound Telephony with high impact to confidentiality, integrity, and availability. An attacker could gain unauthorized access to telephony-integrated customer interaction data, alter routing or queue administration, disrupt service operations, and potentially use the compromised administration plane as a foothold for persistence or further movement within the surrounding Oracle E-Business Suite environment.
If you can’t patch tonight, do this now.
Until patching is completed, reduce exposure of the Oracle E-Business Suite application tier and associated HTTP endpoints. Remove direct internet exposure where possible, place internet-facing HTTP services behind a reverse proxy or URL-filtering layer, and restrict access to trusted networks and administrative users only. For internal deployments, segment the application tier from other network zones and enforce firewall controls between tiers. These measures may reduce attack surface but do not remediate the underlying flaw.
Patch, then assume compromise.
Apply Oracle’s April 2026 Critical Patch Update for Oracle E-Business Suite, specifically the fixes for Oracle Advanced Inbound Telephony Setup and Administration affecting versions 12.2.3 through 12.2.15. Because the vulnerability is unauthenticated, network-reachable, and rated 9.8 CVSS, patching should be treated as a high-priority remediation action on all affected systems.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.