---
id: "CVE-2026-101704"
kind: "vulnerability"
aliases: ["CVE-2026-101704"]
title: "Oracle E-Business Suite: Concurrent Processing flaw lets a privileged user take over"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["no-ebs-installed", "outside-version-range"]
published_at: "2026-10-20T22:18:24+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:04:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101704", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite: Concurrent Processing flaw lets a privileged user take over

Oracle Concurrent Processing, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw that lets a high-privileged local user compromise the product. Per the CVSS vector, a successful attack can also affect other products on the same infrastructure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed E-Business Suite release is between `12.2.3` and `12.2.15`, using the Oracle release information for your environment
- unknown whether the sources list a specific file or setting to inspect

## Fix

- Apply the Oracle Critical Patch Update fix for E-Business Suite Concurrent Processing (version to move to: unknown from these sources)
- Check the Oracle Security Alert advisory for the patched release

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101704

## From the sources

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_