Oracle Concurrent Processing in Oracle E‑Business Suite is vulnerable to a local privilege escalation that allows a highly privileged attacker to gain unauthorized access to critical data or complete control over all data handled by the product. The defect is easily exploitable by an attacker who can log on to the infrastructure where Oracle Concurrent Processing runs. The vulnerability can be triggered without user interaction and results in confidentiality impacts, while integrity and availability remain unaffected.

Oracle Corporation's Oracle Concurrent Processing component of Oracle E‑Business Suite – specifically the Request Submission and Scheduling module – is affected for versions 12.2.3 through 12.2.15. These releases run on the Oracle E‑Business Suite platform.

The CVSS base score of 6.0 shows a moderate severity with a local attack vector, low complexity, high privileges required, and no user interaction. The EPSS score of < 1% indicates a very low exploitation probability, but the flaw is still not listed in the CISA KEV catalog. The flaw can be exploited only by attackers who already have high privileged access to the host environment running Oracle Concurrent Processing, making it a local attack that could lead to significant data confidentiality compromise if host access controls are weak.