CVE-2026-46947: Oracle Outbound Telephony Auth Bypass Flaw

CVE-2026-46947 Overview

CVE-2026-46947 is an access control vulnerability [CWE-284] in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the issue to achieve full takeover of the affected Oracle Advanced Outbound Telephony instance. Oracle published the fix as part of the June 2026 Critical Patch Update for Oracle E-Business Suite.

Critical Impact
Successful exploitation results in complete compromise of confidentiality, integrity, and availability of Oracle Advanced Outbound Telephony, enabling full product takeover by a low-privileged remote attacker.

Affected Products

Oracle Advanced Outbound Telephony 12.2.3
Oracle Advanced Outbound Telephony versions 12.2.4 through 12.2.14
Oracle Advanced Outbound Telephony 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46947 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46947

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. It exists in the Internal Operations component of Oracle Advanced Outbound Telephony, a module of Oracle E-Business Suite used for outbound contact center campaigns. According to Oracle's advisory, the issue is easily exploitable and requires only low privileges. The attacker reaches the vulnerable functionality over the network using HTTP. Successful exploitation results in product takeover, with high impacts to confidentiality, integrity, and availability.

Root Cause

The root cause is improper access control within the Internal Operations component. The application does not adequately enforce authorization on functionality that should be restricted, allowing a user holding only basic application credentials to invoke privileged operations. Oracle has not published implementation-level details. See the Oracle Critical Patch Update Advisory - June 2026 for the vendor's authoritative description.

Attack Vector

The attack vector is network-based over HTTP, requiring no user interaction. The attacker must hold a valid low-privileged account on the Oracle E-Business Suite environment. From there, the attacker issues crafted HTTP requests against the Advanced Outbound Telephony endpoints to access functionality that bypasses intended authorization checks. The result is full takeover of the Advanced Outbound Telephony product.

No public proof-of-concept exploit is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.402% (percentile 31.89).

Detection Methods for CVE-2026-46947

Indicators of Compromise

Unexpected HTTP requests from authenticated low-privileged accounts to Oracle Advanced Outbound Telephony Internal Operations endpoints.
Configuration changes within Advanced Outbound Telephony performed by accounts without administrative responsibilities for the module.
New or modified outbound campaigns, dialer lists, or telephony integration parameters created outside of approved change windows.
Authentication sessions from low-privileged users that suddenly invoke privileged administrative URLs.

Detection Strategies

Review Oracle E-Business Suite access logs and middle-tier web server logs for HTTP requests targeting Advanced Outbound Telephony URIs by non-administrative users.
Correlate Oracle FND_LOGINS and FND_UNSUCCESSFUL_LOGINS audit data with HTTP access patterns to identify privilege misuse.
Build identification rules that flag privileged Advanced Outbound Telephony actions originating from accounts lacking the corresponding responsibility assignment.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On audit and page access tracking, and forward logs to a centralized analytics platform for retention and search.
Monitor outbound network egress from the Oracle E-Business Suite application tier for unusual destinations following authentication events.
Alert on changes to Advanced Outbound Telephony configuration tables and on creation of new responsibilities or grants tied to the module.

How to Mitigate CVE-2026-46947

Immediate Actions Required

Apply the June 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all affected environments running versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite deployments and confirm whether the Advanced Outbound Telephony module is installed and enabled.
Restrict network exposure of the Oracle E-Business Suite application tier so that HTTP access is limited to trusted internal networks and authenticated VPN users.
Review and reduce user responsibilities granting access to Advanced Outbound Telephony to the minimum required population.

Patch Information

Oracle addresses CVE-2026-46947 in the Oracle Critical Patch Update Advisory - June 2026. Administrators must apply the E-Business Suite patch bundle for the 12.2 release line. Oracle recommends applying Critical Patch Update fixes without delay because supported product configurations remain exposed until the patch is installed.

Workarounds

If immediate patching is not feasible, disable the Advanced Outbound Telephony module or revoke responsibilities granting access to its Internal Operations functions until the patch can be deployed.
Place a web application firewall in front of the Oracle E-Business Suite application tier and restrict requests to Advanced Outbound Telephony URIs to known administrative source addresses.
Enforce multi-factor authentication on all Oracle E-Business Suite accounts to raise the cost of acquiring the low-privileged credentials required for exploitation.

bash

# Configuration example: restrict Advanced Outbound Telephony URIs at the reverse proxy
# (adjust paths and admin source ranges to your environment before deploying)
location ~* /OA_HTML/.*(AOT|OutboundTelephony) {
    allow 10.10.20.0/24;   # admin subnet
    deny  all;
    proxy_pass http://ebs-appstier;
}