Concurrent Processing
Monthly
Unauthenticated remote takeover of Oracle E-Business Suite's Concurrent Processing tier (via the BI Publisher Integration component) affects supported releases 12.2.3 through 12.2.14, letting a network attacker with no credentials fully compromise the component over HTTP. Rooted in an authentication weakness (CWE-287), the flaw is confirmed actively exploited (CISA KEV) and was leveraged as a zero-day in a mass-exploitation campaign documented by CrowdStrike, with full confidentiality, integrity, and availability impact (CVSS 9.8).
Oracle Concurrent Processing within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity flaw in its BI Publisher Integration component that allows a low-privileged, authenticated network attacker to compromise data integrity, read restricted data, and cause partial denial of service via HTTP. The vulnerability is described by Oracle as 'easily exploitable,' lowering the bar for abuse by any user holding a valid account. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, though its low attack complexity and no-UI-interaction requirements make it operationally straightforward once credentials are obtained.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Request Submission and Scheduling). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Unauthenticated remote takeover of Oracle E-Business Suite's Concurrent Processing tier (via the BI Publisher Integration component) affects supported releases 12.2.3 through 12.2.14, letting a network attacker with no credentials fully compromise the component over HTTP. Rooted in an authentication weakness (CWE-287), the flaw is confirmed actively exploited (CISA KEV) and was leveraged as a zero-day in a mass-exploitation campaign documented by CrowdStrike, with full confidentiality, integrity, and availability impact (CVSS 9.8).
Oracle Concurrent Processing within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity flaw in its BI Publisher Integration component that allows a low-privileged, authenticated network attacker to compromise data integrity, read restricted data, and cause partial denial of service via HTTP. The vulnerability is described by Oracle as 'easily exploitable,' lowering the bar for abuse by any user holding a valid account. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, though its low attack complexity and no-UI-interaction requirements make it operationally straightforward once credentials are obtained.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Request Submission and Scheduling). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.