Introduction
An unauthenticated attacker with nothing more than HTTP access can fully compromise Oracle Advanced Inbound Telephony, a middleware component embedded in Oracle E-Business Suite that routes customer interactions and surfaces sensitive customer data to agents. CVE-2026-34275 was disclosed on April 21, 2026. It carries a CVSS 3.1 base score of 9.8, affects the Setup and Administration component across a wide range of supported versions, and is one of the most severe items in Oracle's April 2026 Critical Patch Update.
Oracle Advanced Inbound Telephony is the part of Oracle E-Business Suite that routes, queues, and distributes media items for customer interactions. It supports Computer Telephony Integration for both traditional PBX and IP telephony platforms, and it delivers enhanced screen pops containing customer data directly into the E-Business Suite application. Because it connects telephony infrastructure to enterprise data, a compromise of this component reaches well beyond call routing.
Technical Information
The vulnerability exists in the Setup and Administration component of Oracle Advanced Inbound Telephony. The CVSS 3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) gives the clearest picture of the attack surface:
| CVSS Metric | Value | Implication |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over HTTP |
| Attack Complexity | Low | No special conditions or race conditions required |
| Privileges Required | None | Pre-authentication, no credentials needed |
| User Interaction | None | No phishing or social engineering required |
| Scope | Unchanged | Impact is confined to the vulnerable component |
| Confidentiality | High | Full read access to data handled by the component |
| Integrity | High | Full ability to modify data and configuration |
| Availability | High | Full ability to disrupt service |
Together, these metrics describe a flaw that is trivially reachable from the network and needs no authentication, no user interaction, and no special timing. Successful exploitation means a complete takeover of the Oracle Advanced Inbound Telephony environment.
What Is at Stake
Because the component routes and queues customer interactions and pushes customer data into screen pops inside the broader E-Business Suite application, a takeover compromises:
- Customer data flowing through the telephony integration layer
- Call routing logic and queue configuration
- The integrity of the administration plane itself, which could allow persistence or lateral movement within the E-Business Suite environment
Detection Challenges
Oracle has not assigned a Common Weakness Enumeration (CWE) classification to this vulnerability, and the advisory gives no detailed root cause analysis or specific exploit mechanics. That is standard for Oracle's disclosures, but it leaves defenders with a real gap. Public information does not identify the vulnerable endpoint or the nature of the flaw (injection, deserialization, authentication bypass, or something else), so targeted Web Application Firewall rules or intrusion detection signatures cannot be built from it alone. The vendor patch remains the primary and most reliable defense.
Affected Systems and Versions
The vulnerability affects the following:
- Product: Oracle Advanced Inbound Telephony (part of Oracle E-Business Suite)
- Component: Setup and Administration
- Affected Versions: 12.2.3 through 12.2.15
- Protocol: HTTP (network accessible)
Organizations running Oracle E-Business Suite with Advanced Inbound Telephony on versions 12.2.3 through 12.2.15 should consider themselves affected. Environments with the application tier exposed to the internet or to broad internal network segments are at the highest risk.
Recommended Architectural Controls
For organizations that cannot patch immediately, Oracle's own security guidance describes several layers of defense:
| Deployment Scenario | Primary Control |
|---|---|
| Internet-Facing System | Place the HTTP server in a demilitarized zone and remove direct internet exposure to the application tier |
| DMZ Configuration | Maintain a reverse proxy and URL firewall, and expose only products explicitly certified in My Oracle Support article KA1036, Section 6 |
| Internal Network Only | Deploy application tier and database tier on separate subnets, each behind internal firewalls |
These controls reduce exposure but do not eliminate the vulnerability. Patching remains the definitive fix.
Vendor Security History
The April 2026 Critical Patch Update included 18 new security patches for Oracle E-Business Suite alone, and 8 of those vulnerabilities are remotely exploitable without authentication. The highest CVSS score among them was 9.8, the score assigned to CVE-2026-34275. That many critical, pre-authentication vulnerabilities in a single quarterly update stands out.
Threat actors are actively targeting Oracle E-Business Suite for access to sensitive corporate data. Michelin confirmed a data breach directly linked to an attack on its Oracle E-Business Suite infrastructure. Because CVE-2026-34275 needs no authentication and has low attack complexity, it is a particularly attractive candidate for rapid weaponization.
References
- NVD: CVE-2026-34275
- CVE Record: CVE-2026-34275
- Oracle Critical Patch Update Advisory, April 2026
- Text Form of Oracle CPU April 2026 Risk Matrices
- Oracle Advanced Inbound Telephony Implementation Guide
- Oracle E-Business Suite: Overview of Secure Configuration
- Oracle E-Business Suite Security Guide
- Additional Network Infrastructure Security (Oracle)
- Michelin Confirms Data Breach Linked to Oracle EBS Attack (SecurityWeek)
