Oracle Concurrent Processing: Improper access control
Summary
Oracle Concurrent Processing, a component of Oracle E-Business Suite versions 12.2.3 to 12.2.15, contains an improper access control flaw (CWE-284). An attacker with high privileges and local logon on the infrastructure where Concurrent Processing runs can take over the component, and because the scope changes, other products may also be impacted. The attack requires an existing administrative account, so the main risk is for EBS hosts with many admin accounts. CVSS 3.1 base score is 8.2 (High).
Affected
- Oracle E-Business Suite, Oracle Concurrent Processing, supported versions 12.2.3 to 12.2.15
- Component: Other
Fixed in
- Unknown. The fixed EBS patch is not named in the sources reviewed. Check the EBS section of the Oracle Critical Patch Update Advisory - October 2026 for the Concurrent Processing patch.
Workaround
- None documented for this CVE in the sources reviewed.
Exploitation
- No known exploitation in the wild for CVE-2026-101704 in the sources reviewed.
- No public proof-of-concept found.
- EPSS 0.0019 (low).
- Do not confuse with CVE-2026-101767, a different EBS flaw in Application Object Library that is being actively probed.
Our recommendation
- Check whether any EBS instance in version 12.2.3 to 12.2.15 is in scope.
- Apply the October 2026 Critical Patch Update to all EBS patches, not only this CVE, and prioritise internet-facing EBS tiers.
- Limit and review accounts with high privileges in EBS and on the operating system.
- Restrict access to the EBS web tier to trusted networks.
- Review logs for unexpected administrative activity on EBS hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- NVD record and Oracle reference (Vulners) vulners.com
- Vendor data (CNA, Vulners) vulners.com
- Strix summary CVE-2026-101704 www.strix.ai
- BleepingComputer: scanning for recently patched Oracle flaw (CVE-2026-101767) www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:31.
Original description (NVD)
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing. While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.