PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46950 Oracle Corporation CVE debrief

A high-severity vulnerability was found in Oracle Advanced Outbound Telephony, a component of Oracle E-Business Suite. The vulnerability, tracked as CVE-2026-46950, has a CVSS score of 8.8 and can be easily exploited by low-privileged attackers with network access via HTTP, potentially leading to a takeover of the affected system. This vulnerability is located in the Internal Operations component and affects versions 12.2.3-12.2.15 of Oracle Advanced Outbound Telephony.

Vendor
Oracle Corporation
Product
Oracle Advanced Outbound Telephony
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Organizations using Oracle Advanced Outbound Telephony versions 12.2.3-12.2.15 should prioritize patching this vulnerability to prevent potential exploitation. This is particularly important for organizations that rely on Oracle E-Business Suite for critical operations, as the vulnerability can be exploited by low-privileged attackers with network access via HTTP.

Technical summary

The vulnerability is located in the Internal Operations component of Oracle Advanced Outbound Telephony. It has a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high impact on confidentiality, integrity, and availability. The vulnerability is publicly known and has been modified, with Oracle providing a vendor advisory for mitigation. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Outbound Telephony.

Defensive priority

High

Recommended defensive actions

  • Apply the latest security patches provided by Oracle for Oracle Advanced Outbound Telephony.
  • Restrict network access to the affected system to minimize the attack surface.
  • Monitor for suspicious activity and implement compensating controls if patching is not immediately feasible.
  • Review and update asset inventory to ensure all affected systems are accounted for.
  • Implement additional monitoring and detection measures for exposed assets.
  • Track exceptions and retest remediated assets to ensure successful patching.

Evidence notes

The CVE record was published on 2026-06-17T10:54:14.217Z and last modified on 2026-06-17T20:17:18.033Z. The NVD entry is currently Modified. Oracle has provided a vendor advisory for this vulnerability. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and apply patches or mitigations as recommended by Oracle.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46950 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46950

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46950 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46950

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.