{"id":"CVE-2026-91321","kind":"vulnerability","aliases":["CVE-2026-91321"],"related":[],"title":"Oracle iProcurement: Requisition Management flaw lets low-privilege users take over","description":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's iProcurement module, in its Requisition Management component, has a flaw reachable over HTTP by a low-privilege account. Per the NVD entry, a successful attack can lead to full takeover of iProcurement, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iprocurement","on-prem-erp","oracle-ebs","other"],"not_affected_if":["iprocurement-not-installed","version-outside-12.2.3-12.2.15"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use, and whether iProcurement is installed and enabled.\n- Check whether the installed release falls in `12.2.3` through `12.2.15`.","fix":"- Apply the Oracle Critical Patch Update fix for iProcurement in Oracle E-Business Suite (the sources do not name the patch or target version; unknown).","status":"open","published_at":"2026-10-20T22:20:34+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:18:33+00:00","updated_at":"2026-10-25T03:18:33+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:18:33Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for iProcurement in Oracle E-Business Suite (the sources do not name the patch or target version; unknown).","reach":"network","title":"Oracle iProcurement: Requisition Management flaw lets low-privilege users take over","impact":"high","summary":"Oracle E-Business Suite's iProcurement module, in its Requisition Management component, has a flaw reachable over HTTP by a low-privilege account. Per the NVD entry, a successful attack can lead to full takeover of iProcurement, with high impact to confidentiality, integrity and availability.","category":"other","nicknames":[],"who_cares":["oracle-ebs","iprocurement","on-prem-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the iProcurement application, with full data and integrity loss","analyst_note":"Find Oracle's CPU advisory and patch ID for CVE-2026-91321 and confirm the fixed release; the NVD entry gives no fix or check steps.","how_to_check":"- Confirm the Oracle E-Business Suite release in use, and whether iProcurement is installed and enabled.\n- Check whether the installed release falls in `12.2.3` through `12.2.15`.","needs_analyst":true,"not_affected_if":["iprocurement-not-installed","version-outside-12.2.3-12.2.15"],"who_is_affected":"Organizations running Oracle E-Business Suite with the iProcurement module in the affected 12.2.x range, where users can reach it over HTTP. Sites without iProcurement deployed, or outside the listed versions, are not affected per the NVD description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3435,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91321':14A,17A '/av':136C '12.2.15':94C '12.2.3':93C '3.1':123C,135C '7.5':126C 'access':105C 'account':50B 'affect':91C 'allow':99C 'attack':57B,102C,112C 'avail':72B,130C 'base':124C 'busi':29B,82C 'compon':38B,84C 'compromis':109C 'confidenti':69B,127C 'cve':12A,15A 'cvss':122C,132C,134C 'difficult':95C 'e':28B,81C 'e-busi':27B,80C 'eb':25B 'entri':54B 'erp':22B 'exploit':97C 'flaw':5A,41B 'full':61B 'h':144C 'h/a':143C 'h/i':142C 'h/pr':138C 'high':66B 'http':44B,107C 'impact':67B,131C 'integr':70B,128C 'iprocur':2A,18B,32B,64B,76C,110C,121C 'l/ui':139C 'lead':59B 'let':6A 'low':8A,48B,100C 'low-privileg':7A,47B 'manag':4A,37B,86C 'modul':33B 'n/ac':137C 'n/s':140C 'network':104C 'nvd':53B 'on-prem-erp':19B 'oracl':1A,24B,26B,79C 'oracle-eb':23B 'per':51B 'prem':21B 'privileg':9A,49B,101C 'product':77C 'reachabl':42B 'requisit':3A,36B,85C 'result':117C 'score':125C 'success':56B,111C 'suit':30B,83C 'support':87C 'take':11A 'takeov':62B,119C 'u/c':141C 'user':10A 'vector':133C 'version':88C 'via':106C 'vulner':73C,98C,115C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite with the iProcurement module in the affected 12.2.x range, where users can reach it over HTTP. Sites without iProcurement deployed, or outside the listed versions, are not affected per the NVD description.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91321","severity":null,"published_at":"2026-10-20T22:20:34+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}