Oracle Concurrent Processing: Privilege escalation via local access
Summary
Oracle Concurrent Processing, a component of Oracle E-Business Suite 12.2, is affected in versions 12.2.3 through 12.2.15. A low-privileged user who can log on to the infrastructure where Concurrent Processing runs can compromise the component, with a high impact on confidentiality, integrity and availability (CVSS 7.8). No exploitation in the wild or public proof of concept is known at the time of research.
Affected
- Oracle Concurrent Processing (Oracle E-Business Suite 12.2) versions 12.2.3 through 12.2.15
- Other records describe a high-privileged attacker for the same version range; the CNA record (low privileges) is used here.
Fixed in
- Fixed in the Oracle Critical Patch Update of October 2026 (released 20 October 2026).
- Exact EBS patch number for this CVE: Unknown. Check the Oracle advisory.
Workaround
- No vendor workaround known. Patching is the only confirmed fix.
- Restrict logon to EBS application and Concurrent Manager hosts to required users.
- Enforce least privilege on operating system and EBS accounts.
Exploitation
- Exploited in the wild: none known.
- Public proof of concept: none known.
- EPSS score: 0.00171 (low).
- CISA SSVC: Exploitation none, automatable no, technical impact total.
Our recommendation
- If you run EBS 12.2.3 to 12.2.15, apply the October 2026 CPU patches for EBS, Database and Fusion Middleware.
- Confirm the exact patch for CVE-2026-101676 in the Oracle advisory.
- Restrict and monitor logon to EBS hosts until patched.
- Prioritise internet-facing EBS issues in the same release.
- If you do not run EBS, no action needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert October 2026 CPU www.oracle.com
- Vulners CVE record CVE-2026-101676 vulners.com
- Strix CVE-2026-101676 www.strix.ai
- Oracle CPU October 2026 overview (SecurityOnline) securityonline.info
- Breachroad: Oracle CPU October 2026 fixes breachroad.com
- The Hacker News: Hackers target critical Oracle EBS flaw thehackernews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:25.
Original description (NVD)
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.