---
id: "CVE-2026-101701"
kind: "vulnerability"
aliases: ["CVE-2026-101701"]
title: "Oracle E-Business Suite: Concurrent Processing flaw exposes data to privileged local users"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["concurrent-processing", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "unaffected-release"]
published_at: "2026-10-20T22:18:24+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:05:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101701", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite: Concurrent Processing flaw exposes data to privileged local users

Oracle Concurrent Processing in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Request Submission and Scheduling component. A high-privileged user with logon to the host can compromise the component and reach data beyond its own scope, per the CVSS vector (scope change, high confidentiality impact).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release level, for example from the Oracle Applications Manager or the release notes shipped with the install, and check whether it falls in 12.2.3 to 12.2.15
- unknown for any other check; the sources do not name a file or setting to inspect

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Concurrent Processing; the sources do not name the patch number or fixed release
- unknown for a specific version to move to

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101701

## From the sources

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Request Submission and Scheduling).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_