Live › vulnerability › CVE-2026-91316
Go to dashboardOracle E-Business Suite's iProcurement module, in its E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTPS and take it over. The sources say supported versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 score of 7.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the iProcurement module deployed are in scope. The attacker must already hold high privileges, so exposure is mainly a concern where many users hold elevated roles or where internal accounts could be compromised.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91316")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.