Description
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing. While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

A flaw exists in Oracle Concurrent Processing, affecting versions 12.2.3 through 12.2.15. The vulnerability can be exploited by a high‑privileged attacker who has logon access to the infrastructure hosting Oracle Concurrent Processing, allowing the attacker to take control of the component. The compromise may also extend to other Oracle products, changing the scope of impact. Successful exploitation results in full takeover of Oracle Concurrent Processing, compromising confidentiality, integrity, and availability as reflected by the CVSS vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected Systems

The affected product is Oracle Concurrent Processing, a component of Oracle E‑Business Suite. Affected releases are 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS score of 8.2 indicates a high‑severity flaw. The EPSS metric is not available, and the vulnerability is not listed in CISA KEV. The local attack vector and requirement for high‑privileged access mean that only an attacker with existing infrastructure access can exploit the flaw, yet the potential for complete takeover makes the risk significant for organizations relying on the affected releases.

Generated by OpenCVE AI on October 21, 2026 at 03:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Oracle Concurrent Processing to a non‑affected version or apply the vendor’s patch as outlined in the security alert at https://www.oracle.com/security-alerts/cpuoct2026.html
  • Enforce strict access controls to restrict high‑privileged logon rights on infrastructure where Oracle Concurrent Processing runs
  • Perform regular vulnerability scans and validate that no other components remain vulnerable

Generated by OpenCVE AI on October 21, 2026 at 03:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title High Privilege Takeover in Oracle Concurrent Processing
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing. While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle concurrent Processing
CPEs cpe:2.3:a:oracle:concurrent_processing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle concurrent Processing
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Concurrent Processing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T03:55:42.385Z

Reserved: 2026-09-28T15:40:09.501Z

Link: CVE-2026-101704

cve-icon Vulnrichment

Updated: 2026-10-22T15:11:47.944Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:24.843

Modified: 2026-10-27T04:17:37.163

Link: CVE-2026-101704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:45:13Z

Weaknesses