Oracle iProcurement CVE-2026-91316

Exploitation requires an authenticated, high-privileged account on the target Oracle E-Business Suite instance (CVSS PR:H) with network access to the iProcurement E-Content Manager Catalog component over HTTPS. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L), so once the privileged access exists the attack is reliable. The limiting factors are the high privilege prerequisite - which excludes external unauthenticated and low-privilege users - and the narrow affected version window (EBS 12.2.3 through 12.2.15); the primary realistic threat is therefore a malicious or compromised privileged insider rather than an anonymous internet attacker.

This is a genuine but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable (HTTPS), low-complexity attack with full confidentiality, integrity and availability impact - a complete takeover of the iProcurement module. The single most important gating factor is PR:H: the vector itself confirms the attacker must already hold high privileges within the application, which sharply reduces the population of viable attackers and downgrades this from a drive-by remote threat to a privilege-escalation / insider-or-post-compromise concern. No EPSS score, CISA KEV listing, SSVC decision, or POC was provided in the intelligence, so exploitation probability cannot be quantified and there is no evidence of active exploitation - treat it as 'no public exploit identified at time of analysis.' Signals are therefore consistent rather than conflicting: a high (not critical) CVSS score tempered by a high privilege requirement, with no exploitation-maturity data to elevate it. One cross-source discrepancy to flag: the 'Information Disclosure' tag understates the impact - the description and the C:H/I:H/A:H vector both assert full product takeover, not mere disclosure. Prioritize patching in the next Oracle CPU cycle for EBS operators, but this is not an emergency 'patch-now-tonight' item absent evidence of exploitation.

An attacker who has already obtained a high-privileged Oracle E-Business Suite account reaches the iProcurement E-Content Manager Catalog component over HTTPS and sends crafted requests that abuse the flaw to seize full control of the iProcurement module. Because CVSS complexity is low (AC:L), exploitation is reliable once the required privileges are held, but PR:H means an unprivileged or external actor cannot perform this directly. No public proof-of-concept was identified in the provided data.