CVE-2026-91316 in iProcurement
Summary
by MITRE • 10/21/2026
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the E-Content Manager Catalog component of Oracle E-Business Suite, specifically affecting iProcurement versions ranging from 12.2.3 to 12.2.15. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for their procurement workflows. The core issue lies in the handling of requests processed by the catalog management subsystem, which fails to adequately validate or sanitize input data before processing it through internal application logic. While the vulnerability requires high-privileged access and network connectivity via HTTPS to be exploited, its ease of exploitation means that any compromised administrative account with sufficient privileges can leverage this flaw to gain unauthorized control over the iProcurement module. The presence of such a defect in a critical business function underscores the importance of rigorous input validation and secure coding practices within enterprise software development lifecycles.
From an operational perspective, the successful exploitation of this vulnerability leads to a complete takeover of the iProcurement application environment. This outcome aligns with severe impacts on confidentiality, integrity, and availability as reflected in its CVSS 3.1 base score of 7.2. An attacker who gains control over iProcurement can manipulate procurement data, alter purchase orders, or exfiltrate sensitive financial information stored within the system. Furthermore, because Oracle E-Business Suite often integrates with other critical business systems, compromising this module may serve as a pivot point for broader network intrusion. The requirement for high-privileged access does not mitigate the severity significantly in environments where insider threats exist or where administrative credentials have been compromised through phishing or credential stuffing attacks. The ability to execute arbitrary actions within the application context effectively neutralizes existing security controls designed to protect procurement data integrity and availability.
This vulnerability is best classified under CWE-20, which pertains to Improper Input Validation, as the root cause stems from insufficient checks on user-supplied input passed through the HTTPS interface. In terms of adversary behavior mapping according to MITRE ATT&CK, this flaw facilitates techniques associated with Initial Access and Privilege Escalation if combined with other vulnerabilities, though primarily it supports Execution within the application layer. Attackers may utilize this vector to maintain persistence or escalate privileges further depending on the underlying operating system permissions granted to the E-Business Suite service account. The network-based nature of the attack via HTTPS means that while encryption protects data in transit, it does not prevent exploitation if valid credentials are obtained by an adversary who can then interact with the application interface directly.
Mitigation strategies must focus on immediate patching and access control hardening. Oracle has released patches for this vulnerability within subsequent updates to the E-Business Suite suite; therefore, applying the latest security bundle is the primary remediation step. Organizations should verify their current version against the supported range of 12.2.3 through 12.2.15 and prioritize upgrading to a patched release that addresses the input validation flaws in the E-Content Manager Catalog component. In addition to patching, implementing strict network segmentation can limit exposure by restricting HTTPS access to iProcurement endpoints only from trusted administrative subnets or jump hosts. Multi-factor authentication should be enforced for all high-privileged accounts interacting with the system to reduce the likelihood of credential compromise leading to exploitation. Regular vulnerability scanning and penetration testing focused on web application security will help identify similar input validation weaknesses before they can be exploited in production environments.