CVE-2020-2871: Oracle Advanced Outbound Telephony UI flaw allows unauthenticated data access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.2 with no authentication required and high confidentiality impact, plus a very high EPSS percentile, though exploitation requires user interaction and no KEV listing exists.

What it is

Oracle Advanced Outbound Telephony (part of Oracle E-Business Suite) has a vulnerability in its User Interface component affecting versions 12.1.1-12.1.3 and 12.2.3-12.2.9. An unauthenticated network attacker can exploit it, but a person other than the attacker must interact with the application. The record gives no root-cause detail beyond the UI component, so the exact flaw mechanism is unknown.

Impact

Successful exploitation can give unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony data, plus unauthorized insert, update or delete of some of that data. The scope change means other products may also be significantly impacted.

Attack surface

Reached over the network via HTTP against the Oracle Advanced Outbound Telephony user interface; no authentication is required, but the attack requires human interaction by another user. The CVSS vector confirms AV:N, PR:N, UI:R and scope change.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; only vendor advisories are cited. EPSS is high at 0.66186 (99.2nd percentile), indicating elevated predicted exploitation likelihood despite the absence of confirmed in-the-wild activity.

What to do

• Apply the Oracle April 2020 Critical Patch Update (cpuapr2020) for Advanced Outbound Telephony on affected 12.1.1-12.1.3 and 12.2.3-12.2.9 versions.
• Restrict network access to the E-Business Suite HTTP interface to trusted users and networks; do not expose it directly to the internet.
• Enforce user awareness and phishing-resistant controls, since exploitation requires a victim to interact with attacker-supplied content.
• Monitor and limit privileges on Advanced Outbound Telephony data to reduce the impact of unauthorized read or write access.
• If patching is delayed, consider temporarily disabling or restricting the affected UI component where operationally feasible.

Detection

• Review E-Business Suite HTTP access logs for anomalous or unexpected requests to Advanced Outbound Telephony UI endpoints from unauthenticated or unusual sources.
• Alert on unexpected database read or write activity against Advanced Outbound Telephony tables outside normal business patterns.
• Correlate user-reported suspicious links or pages with subsequent E-Business Suite session activity to catch interaction-based exploitation.
• Track Oracle CPU application status for E-Business Suite hosts and flag systems still running affected versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.