{"id":"CVE-2026-101844","aliases":["EUVD-2026-106242","GHSA-6fp6-grq3-gf3c"],"status":"published","title":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component:...","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0023,"percentile":0.1396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-10-20T21:23:17Z","modified":"2026-10-27T12:30:46Z","products":[{"vendor":"oracle corporation","product":"oracle concurrent processing"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101844"},{"url":"https://github.com/advisories/GHSA-6fp6-grq3-gf3c"}],"sources":{"cve":[{"id":"CVE-2026-101844","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","status":"published","published":"2026-10-20T21:23:17.562Z","modified":"2026-10-27T11:37:40.084Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:09.808851Z"}],"euvd":[{"id":"EUVD-2026-106242","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","status":"published","published":"2026-10-20T21:23:17Z","modified":"2026-10-27T11:37:40Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:59:24.427274Z"}],"ghsa":[{"id":"GHSA-6fp6-grq3-gf3c","title":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component:...","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","status":"published","published":"2026-10-21T00:32:36Z","modified":"2026-10-27T12:30:46Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:14:28.758422Z"}],"nvd":[{"id":"CVE-2026-101844","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","status":"published","published":"2026-10-20T22:18:40.403Z","modified":"2026-10-27T12:16:53.35Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:13:01.463896Z"}]}}