Description
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Privileged Access with Full Compromise
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the iProcurement product of Oracle E‑Business Suite, specifically within the E‑Content Manager Catalog component, allows an attacker who already has privileged credentials and network connectivity over HTTPS to take over iProcurement. The flaw enables the attacker to fully compromise the application, resulting in loss of confidentiality, integrity, and availability.

Affected Systems

Oracle iProcurement, versions 12.2.3 through 12.2.15, accessed over HTTPS.

Risk and Exploitability

The CVSS 3.1 base score of 7.2 indicates significant impact. Exploitation is considered easily achievable for a high privileged attacker with network access, though no EPSS score is published and it is not listed in the CISA KEV catalog. The attack vector is likely remote over HTTPS, requiring authentication but providing full takeover once active. The overall risk is high due to the combined severity and the ease of exploitation.

Generated by OpenCVE AI on October 21, 2026 at 08:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle E‑Business Suite patch that addresses CVE-2026-91316 as provided in the Oracle CPUOct2026 advisory.
  • Limit inbound HTTPS connections to iProcurement servers by enforcing network segmentation or VPN access to trusted workstations.
  • Review and enforce least‑privilege policies for all roles that can access iProcurement, and conduct regular audits of privileged accounts.

Generated by OpenCVE AI on October 21, 2026 at 08:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Title iProcurement Remote Privilege Escalation via HTTPS in E‑Content Manager Catalog
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle iprocurement
CPEs cpe:2.3:a:oracle:iprocurement:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle iprocurement
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Iprocurement
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T18:07:48.024Z

Reserved: 2026-09-14T22:10:16.627Z

Link: CVE-2026-91316

cve-icon Vulnrichment

Updated: 2026-10-28T18:07:41.805Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:33.517

Modified: 2026-10-28T19:19:19.533

Link: CVE-2026-91316

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:20:53Z

Weaknesses