EUVD-2026-106242
GHSA-6fp6-grq3-gf3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to Concurrent Requests
-
ImpactRead subset of unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid low-privileged account on the Oracle E-Business Suite instance (PR:L) with network HTTP access to the Concurrent Processing / Concurrent Requests component, and affects supported versions 12.2.3 through 12.2.15. The high attack complexity (AC:H) indicates additional conditions outside the attacker's control (specific state, timing, or configuration) must be met for a successful attack, which significantly limits reliable exploitation. No user interaction is required (UI:N). Impact is limited to unauthorized read access to a subset of Concurrent Processing data - there is no write/integrity or availability impact. |
| Impact | This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 base score of 3.1 (LOW) is driven by three limiting factors in the vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N): high attack complexity (AC:H), the requirement for an existing low-privileged authenticated account (PR:L), and a confidentiality-only impact that is limited (C:L) with no integrity or availability impact (I:N/A:N). No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified - all of which is consistent with a low real-world urgency. There is a notable signal conflict: the input carries an 'Authentication Bypass' tag, yet both the description ('low privileged attacker') and the CVSS vector (PR:L) establish that valid authentication/credentials ARE required, so this tag appears mislabeled and should not be used to justify emergency prioritization. Net assessment: patch during the normal Oracle Critical Patch Update cycle rather than out-of-band. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged application account on an Oracle E-Business Suite 12.2.x deployment sends a specially crafted HTTP request to the Concurrent Processing / Concurrent Requests component to read a subset of data they are not authorized to see. The high attack complexity (AC:H) means success depends on specific conditions or timing beyond the attacker's direct control, making reliable exploitation difficult. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Limited data disclosure in Oracle Concurrent Processing (Oracle E-Business Suite 12.2.3 through 12.2.15) allows an authenticated low-privileged attacker with HTTP access to read a subset of Concurrent Requests data. The CVSS 3.1 score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting high attack complexity and no integrity or availability impact; no public exploit identified at time of analysis.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update for E-Business Suite 12.2.3 through 12.2.15, using the Oracle security alert at https://www.oracle.com/security-alerts/cpuoct2026.html to identify the exact EBS patch; the provided data does not specify a fixed build number. If patching must be deferred, restrict HTTP access to the Concurrent Processing/Concurrent Requests component to trusted networks or roles (trade-off: may block legitimate concurrent-request submissions), review and minimize low-privileged accounts with access to the component (trade-off: may affect job scheduling and request monitoring duties), and monitor HTTP requests to Concurrent Requests for anomalous read activity. Patch availability is per the vendor advisory; an exact patched version is not specified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Concurrent Processing is the E-Business Suite component that manages concurrent request submission, scheduling, and output. The assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable, high-complexity, authenticated issue that exposes only a subset of component-accessible data. No CWE is assigned in the provided data, so the precise root-cause class cannot be confirmed; the impact is limited to confidentiality, with no write or availability effect. Exploitation requires a valid low-privileged EBS account and conditions outside the attacker's control that raise attack complexity, which limits reliable exploitation. A supplied tag labels the issue 'Authentication Bypass,' but the assessed vector requires PR:L and confines impact to C:L, so this should not be read as pre-authentication access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTP vector but AC:H for difficult exploitation and PR:L for the required low-privileged account; limited read-only disclosure gives C:L with I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB