{"id":"CVE-2026-91316","kind":"vulnerability","aliases":["CVE-2026-91316"],"related":[],"title":"Oracle E-Business Suite iProcurement: high-privilege network attacker can take over","description":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's iProcurement module, in its E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTPS and take it over. The sources say supported versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 score of 7.2.","severity":"high","cvss":7.2,"epss":0.00465,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","iprocurement","oracle-ebs","runtime"],"not_affected_if":["iprocurement-not-deployed","versions-outside-12.2.3-12.2.15"],"how_to_check":"- Check the installed Oracle E-Business Suite release and whether iProcurement is deployed, versions in the 12.2.3 to 12.2.15 range are affected\n- unknown for exact patch level checks, the sources do not say","fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that addresses CVE-2026-91316; the fixed patch level is unknown from the sources","status":"open","published_at":"2026-10-20T22:20:33+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:29:05+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:29:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that addresses CVE-2026-91316; the fixed patch level is unknown from the sources","reach":"network","title":"Oracle E-Business Suite iProcurement: high-privilege network attacker can take over","impact":"high","summary":"Oracle E-Business Suite's iProcurement module, in its E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTPS and take it over. The sources say supported versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 score of 7.2.","category":"runtime","nicknames":[],"who_cares":["oracle-ebs","iprocurement","enterprise-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over iProcurement, reading, changing and disrupting its data","analyst_note":"Confirm the Oracle Security Alert or CPU advisory for CVE-2026-91316 to get the patch level and exact remediation steps.","how_to_check":"- Check the installed Oracle E-Business Suite release and whether iProcurement is deployed, versions in the 12.2.3 to 12.2.15 range are affected\n- unknown for exact patch level checks, the sources do not say","needs_analyst":true,"not_affected_if":["iprocurement-not-deployed","versions-outside-12.2.3-12.2.15"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the iProcurement module deployed are in scope. The attacker must already hold high privileges, so exposure is mainly a concern where many users hold elevated roles or where internal accounts could be compromised.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3445,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91316':16A,19A '/av':143C '12.2.15':68B,102C '12.2.3':66B,101C '3.1':74B,130C,142C '7.2':77B,133C 'access':112C 'affect':70B,99C 'allow':106C 'attack':11A,109C,119C 'avail':137C 'base':131C 'busi':4A,31B,87C 'catalog':42B,94C 'compon':43B,89C 'compromis':116C 'confidenti':134C 'content':40B,92C 'cve':14A,17A 'cvss':73B,129C,139C,141C 'e':3A,30B,39B,86C,91C 'e-busi':2A,29B,85C 'e-cont':38B,90C 'easili':103C 'eb':26B 'enterpris':21B 'enterprise-erp':20B 'erp':22B 'exploit':104C 'flaw':46B 'h':151C 'h/a':150C 'h/i':149C 'h/ui':146C 'high':8A,50B,107C 'high-privileg':7A 'https':56B,114C 'impact':138C 'integr':135C 'iprocur':6A,23B,34B,81C,117C,128C 'l/pr':145C 'let':48B 'manag':41B,93C 'modul':35B 'n/ac':144C 'n/s':147C 'network':10A,111C 'oracl':1A,25B,28B,84C 'oracle-eb':24B 'privileg':9A,51B,108C 'product':82C 'reach':53B 'result':124C 'runtim':27B 'say':63B 'score':75B,132C 'sourc':62B 'success':118C 'suit':5A,32B,88C 'support':64B,95C 'take':13A,58B 'takeov':126C 'u/c':148C 'user':52B 'vector':140C 'version':65B,96C 'via':113C 'vulner':78C,105C,122C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the iProcurement module deployed are in scope. The attacker must already hold high privileges, so exposure is mainly a concern where many users hold elevated roles or where internal accounts could be compromised.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91316","severity":null,"published_at":"2026-10-20T22:20:33+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91316","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91316","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}