CVE-2026-91337 in iProcurement
Summary
by MITRE • 10/21/2026
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise iProcurement. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all iProcurement accessible data as well as unauthorized access to critical data or complete access to all iProcurement accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the iProcurement component of Oracle E-Business Suite, specifically affecting internal operations across supported versions ranging from 12.2.3 to 12.2.15. This security flaw presents a significant risk to organizations relying on this enterprise resource planning platform for their procurement workflows. The core issue stems from an insufficient access control mechanism within the application logic that processes requests via HTTPS. Although the vulnerability is classified as difficult to exploit due to high complexity requirements, it allows unauthenticated attackers with network access to bypass standard authentication protocols and interact directly with sensitive internal functions. This lack of proper authorization checks creates a pathway for malicious actors to manipulate system behavior without valid credentials, undermining the fundamental security principle that users must be authenticated before accessing protected resources.
From a technical perspective, this vulnerability is best categorized under CWE-287, which describes Improper Authentication, and potentially CWE-915, Improvement Control using Incorrectly-Resolved Universal Resource Identifier, depending on the specific vector of exploitation within the iProcurement module. The attacker leverages network connectivity to send crafted HTTPS requests that target internal APIs or endpoints not intended for public access. Because the vulnerability allows for both unauthorized creation, deletion, and modification of data as well as unauthorized reading of critical information, it impacts both integrity and confidentiality aspects of security. This dual impact is reflected in the CVSS 3.1 base score of 7.4, indicating a high severity level. The vector string AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N confirms that while availability remains unaffected, the potential for complete data compromise and alteration is substantial once an attack is successfully executed.
The operational impact of this vulnerability extends beyond simple data theft or corruption. iProcurement systems often contain sensitive financial information, vendor contracts, purchase orders, and employee procurement history. Unauthorized access to these datasets can lead to significant financial loss through fraudulent transactions or altered pricing structures. Furthermore, the ability to delete critical records may disrupt business continuity by removing essential audit trails or historical transaction data required for compliance reporting. Attackers could also use this access to modify approval workflows, potentially allowing unauthorized purchases to bypass managerial oversight. In a broader organizational context, such breaches can trigger regulatory penalties under frameworks like GDPR or SOX if sensitive personal or financial data is exposed or altered without authorization. The difficulty of exploitation serves as the primary mitigation factor, requiring attackers to possess specialized knowledge and precise timing to succeed against typical defensive configurations.
To mitigate this risk, organizations should immediately apply the latest security patches provided by Oracle for their specific version of E-Business Suite. Since the vulnerability involves network-accessible HTTPS endpoints, implementing strict firewall rules that restrict access to iProcurement internal APIs only from trusted IP addresses can significantly reduce the attack surface. Additionally, deploying a Web Application Firewall with advanced rule sets capable of detecting anomalous request patterns associated with unauthenticated exploitation attempts provides an effective layer of defense in depth. Security teams should also conduct thorough audits of user permissions within the iProcurement module to ensure that no accounts possess excessive privileges or default credentials that could be leveraged if authentication bypasses are attempted. Regular vulnerability scanning and penetration testing focused on internal operations components will help identify similar misconfigurations before they can be exploited by malicious actors seeking to compromise enterprise procurement systems.