Oracle Concurrent Processing EUVD-2026-106105

Exploitation requires the attacker to already have high-privilege logon access to the infrastructure/host where Oracle Concurrent Processing executes (CVSS AV:L, PR:H) - this is not remotely or anonymously reachable. Affected deployments are Oracle E-Business Suite running Oracle Concurrent Processing versions 12.2.3 through 12.2.15. The main limiting factors are the requirement for pre-existing privileged local access and a supported-but-unpatched 12.2.x installation; no user interaction is required (UI:N). The scope change (S:C) means successful exploitation can impact additional EBS products beyond Concurrent Processing itself.

This is a moderate-priority, context-dependent vulnerability rather than a mass-exploitation threat. The CVSS 3.1 score of 8.2 is driven largely by the scope change (S:C) and full CIA impact (C:H/I:H/A:H), not by ease of reach: the vector is AV:L (local - the attacker must already have logon to the infrastructure where Oracle Concurrent Processing executes) and PR:H (high privileges required). In other words, the attacker must already be a privileged, authenticated local user before this flaw adds value. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or probable near-term exploitation - consistent with a local, high-privilege prerequisite that favors insider or post-compromise lateral-movement scenarios over opportunistic internet-wide attacks. The signals are internally consistent (high impact + scope change justify the 8.2, while AV:L/PR:H correctly keep it below 9.0). Note the 'Information Disclosure' tag understates the actual impact, which Oracle describes as full takeover of Oracle Concurrent Processing with significant impact on additional products - treat this as a full-compromise issue, not merely a disclosure one.

A privileged user (or an attacker who has already compromised a privileged account) with logon access to the host running Oracle Concurrent Processing abuses the vulnerable component to take over Concurrent Processing and, because of the scope change, pivot to impact additional Oracle E-Business Suite products. Because the CVSS vector is AV:L/AC:L/PR:H, exploitation is straightforward once that privileged local foothold exists but cannot be launched remotely or anonymously. No public exploit code is identified at the time of analysis.