Oracle iProcurement EUVD-2026-106575

Exploitation requires (1) network/HTTP access to the iProcurement Requisition Management component, and (2) a valid low-privileged authenticated session (PR:L) - not an anonymous attacker. Affected deployments are Oracle E-Business Suite 12.2.3 through 12.2.15. The strongest limiting factor is Oracle's explicit 'difficult to exploit' rating (AC:H), indicating success depends on conditions outside the attacker's direct control (e.g., specific configuration, timing, or data state) rather than a single deterministic request; no user interaction is required (UI:N). Oracle does not publish the precise feature/setting that gates the flaw, so defenders should treat any low-privileged iProcurement account as a potential launch point and restrict account provisioning plus network exposure accordingly.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5 HIGH) describes a network-reachable but high-complexity flaw requiring low-level authentication, with full confidentiality, integrity, and availability impact (described by Oracle as 'takeover of iProcurement'). The combination of AC:H and PR:L is the key risk dampener: an attacker must already hold a valid low-privileged iProcurement account AND satisfy additional conditions or win a race/configuration-dependent window that Oracle rates as 'difficult to exploit.' No EPSS score was provided, so exploitation probability cannot be quantified. This CVE is NOT in CISA KEV and no POC was supplied, so there is no public exploit identified at time of analysis - this is not confirmed active exploitation. Notably, the input 'Information Disclosure' tag understates the actual impact: the CVSS vector and Oracle's 'takeover' language indicate I:H and A:H, not a confidentiality-only issue. Net: a genuine high-severity patch priority for Oracle EBS operators given full-takeover impact and Oracle's October 2026 CPU inclusion, but the AC:H + PR:L gating makes opportunistic mass exploitation less likely than an unauthenticated AV:N/AC:L flaw; prioritize patching for internet-exposed or multi-tenant EBS instances where low-privileged accounts are broadly provisioned.

An attacker who holds or phishes a low-privileged iProcurement/EBS user account sends crafted HTTP requests to the Requisition Management component, exploiting a high-complexity flaw to escalate to full compromise ('takeover') of the iProcurement module. Because AC:H applies, the attack likely depends on specific timing, configuration, or data state rather than a single trivial request. No public exploit code is known at time of analysis, so this would require original exploit development.