CVE-2026-91321
HighCVSS 7.5Summary
Vulnerability in Oracle E-Business Suite iProcurement (component: Requisition Management) affecting versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability, leading to takeover of iProcurement.
Risk Assessment
Potential takeover of iProcurement by a low-privileged attacker, impacting confidentiality, integrity, and availability.
Recommendation
Apply the Oracle security updates for Oracle E-Business Suite and restrict network access to iProcurement while monitoring low-privileged accounts.
Other vulnerabilities in Oracle E-Business Suite iProcurement
See all- CVE-2026-91337High
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTPS can unauthorized create, delete, or modify critical data and gain unauthorized access to critical data and complete access to all iProcurement data. The vulnerability is difficult to exploit.
- CVE-2026-91316High
Vulnerability in Oracle E-Business Suite iProcurement (component: E-Content Manager Catalog) affecting versions 12.2.3-12.2.15. A high-privileged attacker with network access via HTTPS can easily exploit it, leading to takeover of iProcurement.
- CVE-2026-91260High
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog) affecting versions 12.2.3-12.2.15. A high privileged attacker with network access via HTTP can exploit it to take over iProcurement.
Original NVD description (English source)
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS