---
id: "CVE-2026-91316"
kind: "vulnerability"
aliases: ["CVE-2026-91316"]
title: "Oracle E-Business Suite iProcurement: high-privilege network attacker can take over"
severity: "high"
cvss: 7.2
epss: 0.00465
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["enterprise-erp", "iprocurement", "oracle-ebs", "runtime"]
not_affected_if: ["iprocurement-not-deployed", "versions-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:20:33+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91316", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91316", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle E-Business Suite iProcurement: high-privilege network attacker can take over

Oracle E-Business Suite's iProcurement module, in its E-Content Manager Catalog component, has a flaw that lets a highly privileged user reach it over HTTPS and take it over. The sources say supported versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 score of 7.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release and whether iProcurement is deployed, versions in the 12.2.3 to 12.2.15 range are affected
- unknown for exact patch level checks, the sources do not say

## Fix

- Apply the Oracle Critical Patch Update for E-Business Suite that addresses CVE-2026-91316; the fixed patch level is unknown from the sources

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91316
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91316

## From the sources

Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_