PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3406 Oracle CVE debrief

CVE-2017-3406 is a HIGH-severity Oracle Advanced Outbound Telephony vulnerability in Oracle E-Business Suite. It is network-reachable over HTTP, requires no attacker privileges, but does require user interaction. Oracle’s advisory and NVD indicate affected supported versions include 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6. Successful exploitation can expose critical data and may allow unauthorized data modification in the affected component.

Vendor
Oracle
Product
CVE-2017-3406
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle E-Business Suite administrators, application security teams, and operations teams responsible for Oracle Advanced Outbound Telephony deployments, especially where the user interface is exposed to network-accessible users or external traffic.

Technical summary

NVD lists CVSS v3.0 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N for CVE-2017-3406. The issue is in the User Interface subcomponent of Oracle Advanced Outbound Telephony. Impact is primarily confidentiality, with some integrity impact, and the attack path is unauthenticated but depends on a separate person interacting with the vulnerable interface.

Defensive priority

High

Recommended defensive actions

  • Confirm whether Oracle Advanced Outbound Telephony is deployed in any Oracle E-Business Suite environment.
  • Check whether affected supported versions listed by NVD are in use: 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, and 12.2.6.
  • Apply Oracle’s vendor remediation referenced in the January 2017 CPU advisory where applicable.
  • Restrict exposure of the component to trusted users and networks, especially any HTTP-accessible paths.
  • Review access controls and logging for suspicious interaction with the Advanced Outbound Telephony user interface.
  • Treat the issue as priority if the component is internet-facing or used by broad internal user populations.

Evidence notes

This debrief uses the CVE record published on 2017-01-27 and the NVD record modified on 2026-05-13. The description, affected versions, CVSS vector, and vendor reference are taken from the supplied source corpus only. No exploit steps or unsupported assumptions are included.

Official resources

Published in the CVE/NVD records on 2017-01-27; the NVD entry was later modified on 2026-05-13. Oracle’s January 2017 advisory is the vendor reference cited in NVD.