CVE-2020-2852: Oracle Advanced Outbound Telephony Calendar flaw allows unauthenticated data access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS score is 8.2 (High) with network reachability and no authentication required, though user interaction is needed; EPSS is very high, but no known active exploitation is confirmed.

What it is

A vulnerability in the Calendar component of Oracle Advanced Outbound Telephony (Oracle E-Business Suite) affects versions 12.1.1 through 12.1.3. An unauthenticated network attacker can exploit it, but a successful attack requires human interaction from another person. It can lead to unauthorized access to critical data and modification of some accessible data.

Impact

An attacker can gain unauthorized read access to critical data and limited insert, update, or delete access within Oracle Advanced Outbound Telephony. The scope change means other products may also be significantly impacted.

Attack surface

Reachable over the network via HTTP without authentication, but exploitation requires a user to perform some action (UI:R). The CVSS vector confirms AV:N/AC:L/PR:N/UI:R/S:C.

Exploitation

Not listed in CISA KEV. EPSS probability is 0.66186 (99.2nd percentile), indicating a high likelihood of exploitation activity, but no public exploit references are provided beyond the vendor advisory.

What to do

• Apply the Oracle Critical Patch Update for April 2020 (cpuapr2020) to affected Oracle E-Business Suite versions 12.1.1-12.1.3.
• If patching is delayed, restrict network access to the Oracle Advanced Outbound Telephony Calendar component to trusted users and networks.
• Monitor for and block suspicious HTTP requests targeting the Calendar component, especially those that could trigger user interaction.
• Educate users not to click untrusted links or open unexpected content that could initiate the required human interaction.
• Verify that additional products in scope are reviewed for impact and patched as needed.

Detection

• Monitor web server and application logs for unusual HTTP requests to Oracle Advanced Outbound Telephony Calendar endpoints, particularly from unauthenticated sources.
• Look for anomalous database queries or data access patterns involving the Advanced Outbound Telephony schema that could indicate unauthorized read or write activity.
• Track user reports of unexpected pop-ups, redirects, or content that may be part of a social engineering attempt to trigger the required interaction.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.