CVE-2026-91321 in iProcurement
Summary
by MITRE • 10/21/2026
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Requisition Management component of Oracle E-Business Suite iProcurement, specifically affecting supported versions ranging from 12.2.3 through 12.2.15. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for their procurement workflows. The core issue stems from an architectural or implementation deficiency within the application logic that permits unauthorized access and manipulation of critical system functions. Although the vulnerability is classified as difficult to exploit, requiring high complexity in terms of attack execution, it remains accessible over standard HTTP network connections without any requirement for user interaction such as clicking malicious links or opening crafted files. This characteristic significantly lowers the barrier for automated exploitation tools compared to vulnerabilities that require social engineering components.
From a technical perspective, the flaw allows an attacker with low privileges and valid network access via HTTP to compromise the integrity of the iProcurement application environment. The absence of user interaction requirements means that once an attacker identifies a vulnerable endpoint or input vector within the Requisition Management module, they can potentially trigger the exploit remotely through scripted requests. While the high attack complexity suggests that specific conditions must be met—such as precise timing, knowledge of internal state variables, or exploitation of race conditions—the ability to operate over HTTP without authentication elevation makes it a viable target for persistent attackers who have already gained initial foothold access within the network perimeter or via compromised low-privilege credentials.
The operational impact of this vulnerability is severe, encompassing full compromise of confidentiality, integrity, and availability as indicated by its CVSS 3.1 base score of 7.5. A successful exploitation could lead to a complete takeover of the iProcurement subsystem, allowing attackers to view sensitive procurement data such as vendor contracts, pricing agreements, and employee purchasing history, which constitutes a major breach of confidentiality. Furthermore, integrity is compromised because an attacker can modify requisition details, approve fraudulent purchase orders, or alter approval workflows without detection. Availability impacts arise if the exploitation causes service disruptions or crashes within the application server, hindering business operations related to procurement processes.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-748 Incorrect Default Permissions depending on the specific mechanism allowing low-privileged users to escalate their influence over system resources. The attack vector corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter if script injection is involved, or more broadly falls under lateral movement techniques where an attacker leverages compromised credentials within a trusted network segment to expand access rights. Given the HTTP-based nature of the exploit, it also relates to web application attacks categorized under OWASP Top 10 vulnerabilities such as Broken Access Control or Injection flaws depending on the underlying cause.
Mitigation strategies must prioritize immediate patching by Oracle for all affected versions between 12.2.3 and 12.2.15. Organizations should apply the latest security patches provided in critical patch updates to address these specific defects within the Requisition Management module. In addition to software remediation, network segmentation is recommended to restrict HTTP access to iProcurement servers only from authorized application tiers or management networks rather than exposing them directly to broader enterprise zones. Implementing strict input validation and output encoding at the web server level can also help mitigate potential injection vectors associated with this flaw. Security teams should monitor logs for unusual patterns of low-privilege user activity targeting requisition endpoints, as early detection is crucial given the difficulty but high impact nature of successful exploits.