Live › vulnerability › CVE-2026-91260
Go to dashboardOracle E-Business Suite's iProcurement module, in the E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTP. Successful exploitation can lead to full takeover of iProcurement, per the NVD description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle E-Business Suite iProcurement in the affected version range to , reachable over HTTP. The attacker needs high privileges, so exposure is mainly a concern for environments where many internal users hold elevated roles. Teams not running Oracle E-Business Suite iProcurement can skip it.
12.2.312.2.15No product ranges from the sources yet.
12.2.3 through 12.2.15, per the NVD description.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91260")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.