{"id":"CVE-2026-101672","kind":"vulnerability","aliases":["CVE-2026-101672"],"related":[],"title":"Oracle E-Business Suite: Call Center component flaw allows unauthenticated takeover over RMI","description":"Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Call Center Technology, part of Oracle E-Business Suite 12.2.3 through 12.2.15, has a flaw in its Internal Operations component reachable over RMI. A remote, unauthenticated attacker with network access could take over the Call Center component, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["call-center","java","oracle-ebs","package","rmi","self-hosted"],"not_affected_if":["component-not-installed","rmi-not-network-reachable"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use: `unknown` version lookup command in the sources\n- Check whether the Oracle Call Center Technology component is installed and its RMI listener is reachable from the network: `unknown`","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Call Center Technology, moving off the `12.2.3` to `12.2.15` range; exact patch name: unknown","status":"open","published_at":"2026-10-20T22:18:21+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:06:25+00:00","updated_at":"2026-10-25T03:06:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:06:25Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Call Center Technology, moving off the `12.2.3` to `12.2.15` range; exact patch name: unknown","reach":"network","title":"Oracle E-Business Suite: Call Center component flaw allows unauthenticated takeover over RMI","impact":"high","summary":"Oracle Call Center Technology, part of Oracle E-Business Suite 12.2.3 through 12.2.15, has a flaw in its Internal Operations component reachable over RMI. A remote, unauthenticated attacker with network access could take over the Call Center component, with high impact to confidentiality, integrity and availability.","category":"package","nicknames":[],"who_cares":["oracle-ebs","call-center","rmi","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the Call Center component, reading and changing its data","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-101672 to confirm the patch name, fixed release and exact RMI port and configuration.","how_to_check":"- Confirm the Oracle E-Business Suite release in use: `unknown` version lookup command in the sources\n- Check whether the Oracle Call Center Technology component is installed and its RMI listener is reachable from the network: `unknown`","needs_analyst":true,"not_affected_if":["component-not-installed","rmi-not-network-reachable"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Call Center Technology component (Internal Operations) deployed and its RMI interface reachable over the network. Sites without Call Center Technology installed or with RMI blocked from untrusted networks are less exposed; the sources do not state more precise conditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3460,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101672':17A,20A '-2026':16A,19A '/av':151C '12.2.15':46B,104C '12.2.3':44B,103C '3.1':138C,150C '8.1':141C 'access':64B,114C 'affect':101C 'allow':10A,109C 'attack':61B,111C,124C 'avail':79B,145C 'base':139C 'busi':4A,42B,92C 'call':6A,22B,34B,69B,84C,120C,134C 'call-cent':21B 'center':7A,23B,35B,70B,85C,121C,135C 'compon':8A,54B,71B,94C 'compromis':118C 'confidenti':76B,142C 'could':65B 'cve':15A,18A 'cvss':137C,147C,149C 'difficult':105C 'e':3A,41B,91C 'e-busi':2A,40B,90C 'eb':27B 'exploit':107C 'flaw':9A,49B 'h':159C 'h/a':158C 'h/i':157C 'h/pr':153C 'high':73B 'host':32B 'impact':74B,146C 'integr':77B,143C 'intern':52B,95C 'java':24B 'n/ac':152C 'n/s':155C 'n/ui':154C 'network':63B,113C 'oper':53B,96C 'oracl':1A,26B,33B,39B,83C,89C,119C,133C 'oracle-eb':25B 'packag':28B 'part':37B 'product':87C 'reachabl':55B 'remot':59B 'result':129C 'rmi':14A,29B,57B,116C 'score':140C 'self':31B 'self-host':30B 'success':123C 'suit':5A,43B,93C 'support':97C 'take':66B 'takeov':12A,131C 'technolog':36B,86C,122C,136C 'u/c':156C 'unauthent':11A,60B,110C 'vector':148C 'version':98C 'via':115C 'vulner':80C,108C,127C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Call Center Technology component (Internal Operations) deployed and its RMI interface reachable over the network. Sites without Call Center Technology installed or with RMI blocked from untrusted networks are less exposed; the sources do not state more precise conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101672","severity":null,"published_at":"2026-10-20T22:18:21+00:00","modified_at":"2026-10-21T21:17:34+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}