Oracle iProcurement CVE-2026-91260

Exploitation requires an attacker who already possesses a high-privileged, authenticated account on the target Oracle E-Business Suite instance (CVSS PR:H), plus network HTTP access to the iProcurement E-Content Manager Catalog component, on affected versions 12.2.3 through 12.2.15. There is no user-interaction requirement (UI:N) and attack complexity is low (AC:L), so once the privilege prerequisite is met the attack is straightforward. The dominant limiting factor is the high-privilege requirement, which confines realistic risk to malicious insiders or post-compromise escalation rather than unauthenticated remote attackers; the fixed/default-configuration caveat is not specified in the input.

The signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable, low-complexity attack that nonetheless requires PR:H - a high-privileged, authenticated account - which is the single most important mitigating factor and the reason the score sits at HIGH rather than CRITICAL despite full C/I/A compromise. No EPSS score, CISA KEV listing, or POC indicator was provided in the input, so there is no evidence of active exploitation or public exploit code; this is a vendor-reported (secalert_us@oracle.com) issue disclosed via the Oracle October 2026 Critical Patch Update. The PR:H requirement means an attacker must already have substantial authenticated access, making this far more relevant as a privilege-escalation/insider or post-compromise lateral-movement risk than as a mass-exploitation threat. Note a labeling tension to verify: the single vulnerability tag is 'Information Disclosure,' yet both the description ('takeover of iProcurement') and the vector (I:H/A:H) indicate full integrity and availability compromise, not merely disclosure - treat the tag as understating true impact. CWE is 'N/A' and no EPSS/KEV data was supplied, so exploitation-likelihood scoring could not be cross-referenced.

An attacker who already holds a high-privileged account on an Oracle E-Business Suite instance (12.2.3-12.2.15) sends a crafted HTTP request to the iProcurement E-Content Manager Catalog component. Low attack complexity means the request reliably triggers the flaw, yielding full compromise (takeover) of iProcurement with confidentiality, integrity, and availability impact. No public exploit code was identified in the provided intelligence, so exploitation would currently require independent development.