Description
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

In Oracle Concurrent Processing, a low‑privileged attacker who has logged on to the infrastructure can compromise the component. The vulnerability can lead to an overall takeover, exposing confidentiality, integrity, and availability. The CVSS vector shows local access, low authentication, low privileges, and no user interaction with high impacts on all data and service aspects.

Affected Systems

Oracle Concurrent Processing as part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The CVSS base score of 7.8 highlights a high‑severity risk. Attackers only need local system access and no special conditions beyond a user login to leverage the flaw. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not currently listed in CISA KEV. While the vector is local, a successful compromise can result in full process takeover, making risk significant for environments where the service has elevated privileges.

Generated by OpenCVE AI on October 22, 2026 at 11:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Concurrent Processing security patch released in October 2026 or upgrade to a supported release beyond 12.2.15.
  • Reduce local account access to the server running Oracle Concurrent Processing and disable unused user accounts.
  • Enforce role‑based access controls and remove unnecessary privileges from users that can log on to the infrastructure.

Generated by OpenCVE AI on October 22, 2026 at 11:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation and Process Takeover in Oracle Concurrent Processing

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Takeover of Oracle Concurrent Processing
Weaknesses CWE-269
CWE-862

Wed, 21 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Takeover of Oracle Concurrent Processing
Weaknesses CWE-269
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle concurrent Processing
CPEs cpe:2.3:a:oracle:concurrent_processing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle concurrent Processing
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Concurrent Processing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-03T04:55:58.138Z

Reserved: 2026-09-28T15:40:09.499Z

Link: CVE-2026-101676

cve-icon Vulnrichment

Updated: 2026-10-21T19:06:59.632Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:22.007

Modified: 2026-11-03T05:18:27.377

Link: CVE-2026-101676

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:15:07Z

Weaknesses