CVE-2026-46949: Oracle Outbound Telephony Auth Bypass Flaw

CVE-2026-46949 Overview

CVE-2026-46949 is an access control vulnerability [CWE-284] in the Internal Operations component of Oracle Advanced Outbound Telephony, part of the Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15 and is exploitable over HTTP without authentication or user interaction. An unauthenticated network attacker can compromise confidentiality and integrity of all data accessible to the application. Oracle disclosed the issue in its June 2026 Critical Patch Update advisory.

Critical Impact
An unauthenticated remote attacker can read, create, modify, or delete all data accessible to Oracle Advanced Outbound Telephony through HTTP requests, with no privileges or user interaction required.

Affected Products

Oracle Advanced Outbound Telephony 12.2.3
Oracle Advanced Outbound Telephony versions 12.2.4 through 12.2.14
Oracle Advanced Outbound Telephony 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46949 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases fix in the Oracle Critical Patch Update Advisory - June 2026

Technical Details for CVE-2026-46949

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Advanced Outbound Telephony, a campaign and call-routing module within Oracle E-Business Suite. The flaw allows attackers to interact with privileged functionality over HTTP without presenting credentials. Successful exploitation grants unauthorized read access to all application-accessible data and the ability to create, modify, or delete records. Because exploitation requires only network reachability and no user interaction, internet-exposed Oracle E-Business Suite deployments face the highest risk.

Root Cause

Oracle classifies the defect under the Improper Access Control weakness category [CWE-284]. The Internal Operations component fails to enforce authentication or authorization checks on a network-accessible interface. Oracle has not published low-level technical specifics, consistent with its Critical Patch Update disclosure policy.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated attacker sends crafted HTTP requests to an exposed Oracle Advanced Outbound Telephony endpoint to reach the vulnerable Internal Operations functions. No prior foothold, credentials, or social engineering are required. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability stands at 0.396%.

No verified public exploit code is available. Refer to the Oracle Security Alert for vendor-provided remediation details.

Detection Methods for CVE-2026-46949

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Advanced Outbound Telephony URIs containing Internal Operations component paths from external or unexpected source addresses.
Unexplained creation, modification, or deletion of records in Advanced Outbound Telephony tables outside scheduled campaign activity.
Anomalous HTTP response sizes from Oracle E-Business Suite hosts indicating bulk data retrieval by anonymous sessions.

Detection Strategies

Inspect Oracle HTTP Server and Web Application Server access logs for requests to Advanced Outbound Telephony endpoints lacking an authenticated session cookie or ICX_SESSION token.
Correlate database audit records for Advanced Outbound Telephony schemas against authenticated application sessions to surface orphaned write operations.
Deploy network signatures on perimeter sensors to flag direct HTTP access to Oracle E-Business Suite module paths from untrusted networks.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and database fine-grained auditing on Advanced Outbound Telephony tables to record all DML operations.
Forward Oracle HTTP Server logs and database audit trails to a centralized SIEM for retention and correlation across the E-Business Suite tier.
Monitor for spikes in 200-status responses against Advanced Outbound Telephony URIs from a small number of source IPs, which may indicate data exfiltration.

How to Mitigate CVE-2026-46949

Immediate Actions Required

Apply the patches in the Oracle Critical Patch Update Advisory - June 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory all Oracle E-Business Suite deployments and confirm whether the Advanced Outbound Telephony module is licensed and enabled.
Remove direct internet exposure of Oracle E-Business Suite hosts and place them behind a reverse proxy or VPN until patched.

Patch Information

Oracle addresses CVE-2026-46949 in the June 2026 Critical Patch Update. Customers running Oracle E-Business Suite 12.2.3 through 12.2.15 must install the fix bundle referenced in the advisory. Oracle policy restricts security patches to supported releases, so unsupported versions should be upgraded to 12.2 with the latest Application Release Update Pack before patching.

Workarounds

Restrict HTTP access to Advanced Outbound Telephony URIs at the Oracle HTTP Server or load balancer to authenticated internal subnets only.
Disable the Advanced Outbound Telephony responsibility for environments that do not use the module until the patch is applied.
Enforce web application firewall rules that block unauthenticated requests to Oracle E-Business Suite Internal Operations component paths.

bash

# Example Oracle HTTP Server access restriction for Advanced Outbound Telephony paths
<LocationMatch "^/OA_HTML/.*(IEO|AdvancedOutbound).*">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</LocationMatch>