---
id: "CVE-2026-91260"
kind: "vulnerability"
aliases: ["CVE-2026-91260"]
title: "Oracle E-Business Suite iProcurement: high-privilege attacker can take over component"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["enterprise-apps", "iprocurement", "oracle-ebs", "runtime"]
not_affected_if: ["not-running-iprocurement", "unaffected-version"]
published_at: "2026-10-20T22:20:26+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T03:29:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91260", "first_seen_at": "2026-10-23T21:57:26+00:00"}]
---

# Oracle E-Business Suite iProcurement: high-privilege attacker can take over component

Oracle E-Business Suite's iProcurement module, in the E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTP. Successful exploitation can lead to full takeover of iProcurement, per the NVD description.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the iProcurement version in use: affected supported versions are `12.2.3` through `12.2.15`, per the NVD description.
- Check whether the E-Content Manager Catalog component is in use: unknown

## Fix

- Apply the Oracle Critical Patch Update fix for iProcurement: unknown (the sources do not name the patched release or patch number).

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91260

## From the sources

Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_