{"id":"CVE-2026-91260","kind":"vulnerability","aliases":["CVE-2026-91260"],"related":[],"title":"Oracle E-Business Suite iProcurement: high-privilege attacker can take over component","description":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's iProcurement module, in the E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTP. Successful exploitation can lead to full takeover of iProcurement, per the NVD description.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","iprocurement","oracle-ebs","runtime"],"not_affected_if":["not-running-iprocurement","unaffected-version"],"how_to_check":"- Confirm the iProcurement version in use: affected supported versions are `12.2.3` through `12.2.15`, per the NVD description.\n- Check whether the E-Content Manager Catalog component is in use: unknown","fix":"- Apply the Oracle Critical Patch Update fix for iProcurement: unknown (the sources do not name the patched release or patch number).","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:29:08+00:00","updated_at":"2026-10-25T03:29:08+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for iProcurement: unknown (the sources do not name the patched release or patch number).","reach":"network","title":"Oracle E-Business Suite iProcurement: high-privilege attacker can take over component","impact":"high","summary":"Oracle E-Business Suite's iProcurement module, in the E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTP. Successful exploitation can lead to full takeover of iProcurement, per the NVD description.","category":"runtime","nicknames":[],"who_cares":["oracle-ebs","iprocurement","enterprise-apps"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the iProcurement application and its data.","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed iProcurement patch and whether the E-Content Manager Catalog component has a specific configuration requirement.","how_to_check":"- Confirm the iProcurement version in use: affected supported versions are `12.2.3` through `12.2.15`, per the NVD description.\n- Check whether the E-Content Manager Catalog component is in use: unknown","needs_analyst":true,"not_affected_if":["not-running-iprocurement","unaffected-version"],"who_is_affected":"Organizations running Oracle E-Business Suite iProcurement in the affected version range `12.2.3` to `12.2.15`, reachable over HTTP. The attacker needs high privileges, so exposure is mainly a concern for environments where many internal users hold elevated roles. Teams not running Oracle E-Business Suite iProcurement can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":3444,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91260':17A,20A '/av':136C '12.2.15':95C '12.2.3':94C '3.1':123C,135C '7.2':126C 'access':105C 'affect':92C 'allow':99C 'app':23B 'attack':10A,102C,112C 'avail':130C 'base':124C 'busi':4A,32B,80C 'catalog':43B,87C 'compon':14A,44B,82C 'compromis':109C 'confidenti':127C 'content':41B,85C 'cve':15A,18A 'cvss':122C,132C,134C 'descript':70B 'e':3A,31B,40B,79C,84C 'e-busi':2A,30B,78C 'e-cont':39B,83C 'easili':96C 'eb':27B 'enterpris':22B 'enterprise-app':21B 'exploit':59B,97C 'flaw':47B 'full':63B 'h':144C 'h/a':143C 'h/i':142C 'h/ui':139C 'high':8A,51B,100C 'high-privileg':7A 'http':57B,107C 'impact':131C 'integr':128C 'iprocur':6A,24B,35B,66B,74C,110C,121C 'l/pr':138C 'lead':61B 'let':49B 'manag':42B,86C 'modul':36B 'n/ac':137C 'n/s':140C 'network':104C 'nvd':69B 'oracl':1A,26B,29B,77C 'oracle-eb':25B 'per':67B 'privileg':9A,52B,101C 'product':75C 'reach':54B 'result':117C 'runtim':28B 'score':125C 'success':58B,111C 'suit':5A,33B,81C 'support':88C 'take':12A 'takeov':64B,119C 'u/c':141C 'user':53B 'vector':133C 'version':89C 'via':106C 'vulner':71C,98C,115C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite iProcurement in the affected version range `12.2.3` to `12.2.15`, reachable over HTTP. The attacker needs high privileges, so exposure is mainly a concern for environments where many internal users hold elevated roles. Teams not running Oracle E-Business Suite iProcurement can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91260","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}