{"id":"CVE-2026-101704","kind":"vulnerability","aliases":["CVE-2026-101704"],"related":[],"title":"Oracle E-Business Suite: Concurrent Processing flaw lets a privileged user take over","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Concurrent Processing, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw that lets a high-privileged local user compromise the product. Per the CVSS vector, a successful attack can also affect other products on the same infrastructure.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","package","self-hosted"],"not_affected_if":["no-ebs-installed","outside-version-range"],"how_to_check":"- Confirm the installed E-Business Suite release is between `12.2.3` and `12.2.15`, using the Oracle release information for your environment\n- unknown whether the sources list a specific file or setting to inspect","fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite Concurrent Processing (version to move to: unknown from these sources)\n- Check the Oracle Security Alert advisory for the patched release","status":"open","published_at":"2026-10-20T22:18:24+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:04:09+00:00","updated_at":"2026-10-25T03:04:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:04:09Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite Concurrent Processing (version to move to: unknown from these sources)\n- Check the Oracle Security Alert advisory for the patched release","reach":"local","title":"Oracle E-Business Suite: Concurrent Processing flaw lets a privileged user take over","impact":"high","summary":"Oracle Concurrent Processing, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw that lets a high-privileged local user compromise the product. Per the CVSS vector, a successful attack can also affect other products on the same infrastructure.","category":"package","nicknames":[],"who_cares":["oracle-ebs","self-hosted","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"high-privileged local user takes over Concurrent Processing and affects other products","analyst_note":"Find the Oracle Security Alert patch number and fixed release for 12.2.x from the NVD entry's Oracle advisory links, and confirm the component file or check to inspect.","how_to_check":"- Confirm the installed E-Business Suite release is between `12.2.3` and `12.2.15`, using the Oracle release information for your environment\n- unknown whether the sources list a specific file or setting to inspect","needs_analyst":true,"not_affected_if":["outside-version-range","no-ebs-installed"],"who_is_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with Concurrent Processing on the server. Exploitation needs a high-privileged account with logon access to the host where Concurrent Processing runs, so exposure is mainly from insiders or already-compromised admin accounts. Teams not running E-Business Suite in this version range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3511,"output_tokens":662,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101704':16A,19A '-2026':15A,18A '/av':161C '12.2.15':42B,95C '12.2.3':40B,94C '3.1':148C,160C '8.2':151C 'addit':130C 'affect':66B,92C 'allow':99C 'also':65B 'attack':63B,102C,126C,135C 'avail':155C 'base':149C 'busi':4A,37B,84C 'c/c':166C 'chang':133C 'compon':32B,86C 'compromis':54B,114C 'concurr':6A,29B,77C,110C,116C,124C,145C 'confidenti':152C 'cve':14A,17A 'cvss':59B,147C,157C,159C 'e':3A,36B,83C 'e-busi':2A,35B,82C 'easili':96C 'eb':23B 'erp':20B 'execut':112C 'exploit':97C 'flaw':8A,45B 'h':169C 'h/a':168C 'h/i':167C 'h/ui':164C 'high':50B,100C 'high-privileg':49B 'host':27B 'impact':129C,156C 'infrastructur':72B,107C 'integr':153C 'l/ac':162C 'l/pr':163C 'let':9A,47B 'local':52B 'logon':104C 'may':127C 'n/s':165C 'oracl':1A,22B,28B,34B,76C,81C,109C,115C,123C,144C 'oracle-eb':21B 'packag':24B 'per':57B 'privileg':11A,51B,101C 'process':7A,30B,78C,111C,117C,125C,146C 'product':56B,68B,79C,131C 'result':140C 'scope':132C 'score':150C 'self':26B 'self-host':25B 'signific':128C 'success':62B,134C 'suit':5A,38B,85C 'support':88C 'take':13A 'takeov':142C 'user':12A,53B 'vector':60B,158C 'version':39B,89C 'vulner':73C,98C,120C,138C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with Concurrent Processing on the server. Exploitation needs a high-privileged account with logon access to the host where Concurrent Processing runs, so exposure is mainly from insiders or already-compromised admin accounts. Teams not running E-Business Suite in this version range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101704","severity":null,"published_at":"2026-10-20T22:18:24+00:00","modified_at":"2026-10-22T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}