{"id":"CVE-2026-101701","kind":"vulnerability","aliases":["CVE-2026-101701"],"related":[],"title":"Oracle E-Business Suite: Concurrent Processing flaw exposes data to privileged local users","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Request Submission and Scheduling).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Concurrent Processing in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Request Submission and Scheduling component. A high-privileged user with logon to the host can compromise the component and reach data beyond its own scope, per the CVSS vector (scope change, high confidentiality impact).","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["concurrent-processing","oracle-ebs","self-hosted","vendor"],"not_affected_if":["auth-required","unaffected-release"],"how_to_check":"- Confirm the Oracle E-Business Suite release level, for example from the Oracle Applications Manager or the release notes shipped with the install, and check whether it falls in 12.2.3 to 12.2.15\n- unknown for any other check; the sources do not name a file or setting to inspect","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Concurrent Processing; the sources do not name the patch number or fixed release\n- unknown for a specific version to move to","status":"open","published_at":"2026-10-20T22:18:24+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:05:42+00:00","updated_at":"2026-10-25T04:05:42+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:05:42Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Concurrent Processing; the sources do not name the patch number or fixed release\n- unknown for a specific version to move to","reach":"local","title":"Oracle E-Business Suite: Concurrent Processing flaw exposes data to privileged local users","impact":"high","summary":"Oracle Concurrent Processing in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Request Submission and Scheduling component. A high-privileged user with logon to the host can compromise the component and reach data beyond its own scope, per the CVSS vector (scope change, high confidentiality impact).","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","concurrent-processing","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Privileged local user reads critical data across Concurrent Processing","analyst_note":"Find the Oracle Critical Patch Update advisory listing the fixed 12.2.x release and patch number for CVE-2026-101701; the NVD entry does not give them.","how_to_check":"- Confirm the Oracle E-Business Suite release level, for example from the Oracle Applications Manager or the release notes shipped with the install, and check whether it falls in 12.2.3 to 12.2.15\n- unknown for any other check; the sources do not name a file or setting to inspect","needs_analyst":true,"not_affected_if":["unaffected-release","auth-required"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Concurrent Processing. Exposure needs an attacker who already holds high privileges and a logon to the infrastructure where Concurrent Processing runs, so the risk sits with internal accounts rather than anonymous internet users. Teams on unaffected releases or fully patched 12.2.x builds can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":3532,"output_tokens":707,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101701':17A,20A '-2026':16A,19A '/av':180C '12.2.15':41B,107C '12.2.3':39B,106C '3.1':170C,179C '6.0':173C 'access':155C,161C,167C 'addit':142C 'affect':104C 'allow':111C 'attack':114C,138C,147C 'base':171C 'beyond':69B 'busi':4A,37B,93C 'c/c':185C 'chang':78B,145C 'complet':160C 'compon':51B,65B,95C 'compromis':63B,126C 'concurr':6A,22B,32B,86C,122C,128C,136C,165C 'concurrent-process':21B 'confidenti':80B,174C 'critic':157C 'cve':15A,18A 'cvss':75B,169C,176C,178C 'data':10A,68B,158C,168C 'e':3A,36B,92C 'e-busi':2A,35B,91C 'easili':108C 'eb':26B 'execut':124C 'exploit':109C 'expos':9A 'flaw':8A,44B 'h/i':186C 'h/ui':183C 'high':54B,79B,112C 'high-privileg':53B 'host':29B,61B 'impact':81B,141C,175C 'infrastructur':119C 'l/ac':181C 'l/pr':182C 'local':13A 'logon':58B,116C 'may':139C 'n':188C 'n/a':187C 'n/s':184C 'oracl':1A,25B,31B,85C,90C,121C,127C,135C,164C 'oracle-eb':24B 'per':73B 'privileg':12A,55B,113C 'process':7A,23B,33B,87C,123C,129C,137C,166C 'product':88C,143C 'reach':67B 'request':47B,96C 'result':152C 'schedul':50B,99C 'scope':72B,77B,144C 'score':172C 'self':28B 'self-host':27B 'signific':140C 'submiss':48B,97C 'success':146C 'suit':5A,38B,94C 'support':100C 'unauthor':154C 'user':14A,56B 'vector':76B,177C 'vendor':30B 'version':101C 'vulner':82C,110C,132C,150C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with Concurrent Processing. Exposure needs an attacker who already holds high privileges and a logon to the infrastructure where Concurrent Processing runs, so the risk sits with internal accounts rather than anonymous internet users. Teams on unaffected releases or fully patched 12.2.x builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101701","severity":null,"published_at":"2026-10-20T22:18:24+00:00","modified_at":"2026-10-22T18:17:14+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}