CVE-2026-91260
HighCVSS 7.2Summary
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog) affecting versions 12.2.3-12.2.15. A high privileged attacker with network access via HTTP can exploit it to take over iProcurement.
Risk Assessment
Successful exploitation can lead to takeover of iProcurement, threatening confidentiality, integrity and availability of business data.
Recommendation
Apply the Oracle patch for iProcurement immediately and restrict network access to the application to trusted administrators only.
Other vulnerabilities in Oracle E-Business Suite iProcurement
See all- CVE-2026-91337High
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTPS can unauthorized create, delete, or modify critical data and gain unauthorized access to critical data and complete access to all iProcurement data. The vulnerability is difficult to exploit.
- CVE-2026-91321High
Vulnerability in Oracle E-Business Suite iProcurement (component: Requisition Management) affecting versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability, leading to takeover of iProcurement.
- CVE-2026-91316High
Vulnerability in Oracle E-Business Suite iProcurement (component: E-Content Manager Catalog) affecting versions 12.2.3-12.2.15. A high-privileged attacker with network access via HTTPS can easily exploit it, leading to takeover of iProcurement.
Original NVD description (English source)
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS