---
id: "CVE-2026-101672"
kind: "vulnerability"
aliases: ["CVE-2026-101672"]
title: "Oracle E-Business Suite: Call Center component flaw allows unauthenticated takeover over RMI"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["call-center", "java", "oracle-ebs", "package", "rmi", "self-hosted"]
not_affected_if: ["component-not-installed", "rmi-not-network-reachable"]
published_at: "2026-10-20T22:18:21+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:06:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101672", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite: Call Center component flaw allows unauthenticated takeover over RMI

Oracle Call Center Technology, part of Oracle E-Business Suite 12.2.3 through 12.2.15, has a flaw in its Internal Operations component reachable over RMI. A remote, unauthenticated attacker with network access could take over the Call Center component, with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release in use: `unknown` version lookup command in the sources
- Check whether the Oracle Call Center Technology component is installed and its RMI listener is reachable from the network: `unknown`

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Call Center Technology, moving off the `12.2.3` to `12.2.15` range; exact patch name: unknown

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101672

## From the sources

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_