---
id: "CVE-2026-91321"
kind: "vulnerability"
aliases: ["CVE-2026-91321"]
title: "Oracle iProcurement: Requisition Management flaw lets low-privilege users take over"
severity: "high"
cvss: 7.5
epss: 0.00345
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["iprocurement", "on-prem-erp", "oracle-ebs", "other"]
not_affected_if: ["iprocurement-not-installed", "version-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:20:34+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91321", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91321", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle iProcurement: Requisition Management flaw lets low-privilege users take over

Oracle E-Business Suite's iProcurement module, in its Requisition Management component, has a flaw reachable over HTTP by a low-privilege account. Per the NVD entry, a successful attack can lead to full takeover of iProcurement, with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release in use, and whether iProcurement is installed and enabled.
- Check whether the installed release falls in `12.2.3` through `12.2.15`.

## Fix

- Apply the Oracle Critical Patch Update fix for iProcurement in Oracle E-Business Suite (the sources do not name the patch or target version; unknown).

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91321
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91321

## From the sources

Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_