CVE-2026-46950: Oracle Outbound Telephony Auth Bypass Flaw

CVE-2026-46950 Overview

CVE-2026-46950 is a high-severity vulnerability in the Internal Operations component of Oracle Advanced Outbound Telephony, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access via HTTP can compromise the product without user interaction. Successful exploitation results in full takeover of Oracle Advanced Outbound Telephony, impacting confidentiality, integrity, and availability. Oracle addressed the issue in its June 2026 Critical Security Patch Update. The vulnerability maps to [CWE-284: Improper Access Control].

Critical Impact
Successful exploitation grants attackers full takeover of Oracle Advanced Outbound Telephony, exposing call data, agent operations, and integrated E-Business Suite resources.

Affected Products

Oracle Advanced Outbound Telephony 12.2.3
Oracle Advanced Outbound Telephony 12.2.4 through 12.2.14
Oracle Advanced Outbound Telephony 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46950 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46950

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Advanced Outbound Telephony, a module within Oracle E-Business Suite used for predictive outbound dialing and campaign management. The flaw is classified under [CWE-284] (Improper Access Control), indicating that the application fails to enforce sufficient authorization checks on a network-reachable HTTP endpoint.

An authenticated attacker holding only low-level application privileges can issue crafted HTTP requests to reach functionality that should be restricted. Because the affected logic sits inside the Internal Operations component, successful interaction grants the attacker control over data and operations belonging to higher-privileged users. The result is a full takeover of the Advanced Outbound Telephony module with consequences for confidentiality, integrity, and availability.

The EPSS score is 0.402% (31.9 percentile), and no public exploit code or in-the-wild exploitation has been reported at this time.

Root Cause

The underlying issue is improper access control on functionality exposed through HTTP to authenticated users of Oracle E-Business Suite. The component does not adequately validate whether the calling principal is authorized for the requested action, allowing privilege boundaries inside the Telephony module to be crossed.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. The attacker sends crafted requests targeting the Internal Operations endpoints of Oracle Advanced Outbound Telephony. No user interaction is required, and attack complexity is low, making the vulnerability practical to weaponize in environments where E-Business Suite is exposed beyond a tightly controlled administrative network.

No verified proof-of-concept code is available. Refer to the Oracle Critical Security Patch Update Advisory - June 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-46950

Indicators of Compromise

Unexpected HTTP requests to Oracle Advanced Outbound Telephony Internal Operations endpoints from accounts that do not normally interact with that module.
New or modified outbound dial campaigns, agent configurations, or list management entries created by low-privileged user accounts.
Anomalous session activity in Oracle E-Business Suite audit tables (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES) tied to telephony URLs.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page-access tracking for telephony-related responsibilities.
Inspect web tier access logs for HTTP requests targeting OA.jsp and servlet paths associated with the Advanced Outbound Telephony module from non-administrative users.
Correlate database audit events on telephony schemas (IEO, IEC) with the originating application user to identify privilege boundary violations.

Monitoring Recommendations

Forward Oracle E-Business Suite application, web tier, and database audit logs to a centralized analytics platform for correlation and retention.
Alert on bursts of HTTP 200 responses to Internal Operations URIs originating from accounts without telephony administration roles.
Baseline normal telephony module usage per user and responsibility, then alert on deviations such as off-hours access or unusual source IP ranges.

How to Mitigate CVE-2026-46950

Immediate Actions Required

Apply the Oracle June 2026 Critical Patch Update to all Oracle E-Business Suite environments running Advanced Outbound Telephony 12.2.3 through 12.2.15.
Inventory accounts with access to Advanced Outbound Telephony responsibilities and revoke any that are not strictly required.
Restrict network reachability of the E-Business Suite web tier to trusted corporate networks and VPN endpoints.

Patch Information

Oracle released a fix as part of the June 2026 Critical Patch Update. Administrators should follow the patching instructions provided in the Oracle Critical Security Patch Update Advisory - June 2026 and validate the patch in a non-production environment before rolling it to production E-Business Suite instances.

Workarounds

Disable or unassign the Advanced Outbound Telephony responsibilities for any user that does not actively use the module until patching is complete.
Place a reverse proxy or web application firewall in front of the E-Business Suite web tier and block external access to Internal Operations URIs.
Enforce strong authentication and session controls on E-Business Suite logins to limit the value of compromised low-privileged credentials.

bash

# Example: restrict access to telephony Internal Operations URIs at the reverse proxy
location ~* /OA_HTML/.*(ieo|advanced_outbound).* {
    allow 10.10.0.0/16;   # internal telephony admin subnet
    deny  all;
    proxy_pass http://ebs-web-tier;
}