Oracle Concurrent Processing EUVD-2026-106108

Exploitation is remote and unauthenticated (AV:N/PR:N/UI:N) against the Oracle E-Business Suite Concurrent Processing component reachable over HTTP, affecting versions 12.2.3 through 12.2.15. The decisive limiting factor is the high attack complexity (AC:H): Oracle classifies this as 'difficult to exploit', meaning the attacker must satisfy conditions outside their control - likely specific timing, application state, or a race - rather than issue a single deterministic request. Oracle does not name the exact feature, protocol option, or configuration flag that must be present, so the precise precondition is undisclosed. Realistic risk is therefore gated primarily by (a) whether the EBS web tier is exposed to untrusted networks and (b) the attacker's ability to reliably meet the AC:H conditions; there is no availability impact (A:N).

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.4 (HIGH) is driven by network reach (AV:N over HTTP), no authentication (PR:N), and no user interaction (UI:N), combined with high confidentiality and integrity impact (C:H/I:H), which is serious for an ERP data store. The single most important mitigating signal is AC:H - Oracle explicitly describes this as a 'difficult to exploit' vulnerability, meaning successful attack depends on conditions outside the attacker's direct control (timing, race, or specific state), which materially lowers the odds of reliable, repeatable exploitation. No EPSS score was provided in the input, so the statistical exploitation probability cannot be weighed. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or weaponization at this time. No SSVC decision data was supplied. Net: a real HIGH-severity data exposure/tamper flaw in a sensitive enterprise product, but the AC:H gate and absence of KEV/POC/EPSS signals argue for prompt patching within the normal Oracle CPU cycle rather than emergency out-of-band response - unless organization-specific threat intel elevates it. Note that Oracle E-Business Suite components have been targeted in past campaigns, so exposure of the EBS web tier to untrusted networks increases practical concern despite the complexity barrier.

An unauthenticated attacker with network access to the Oracle E-Business Suite web tier sends specially crafted HTTP requests to the Concurrent Processing component, and by meeting the specific (difficult, AC:H) preconditions is able to read, create, modify, or delete critical application data without logging in. No public exploit code is referenced, and exploitation requires winning hard-to-control conditions rather than a simple single request.