EUVD-2026-106591
GHSA-3p24-w3pm-cxjw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach iProcurement over HTTPS
-
DeliverySend crafted request to Internal Operations
-
ExploitMeet high-complexity exploitation condition
-
ExecutionGain unauthenticated data access
-
ImpactRead or alter critical iProcurement data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Internal Operations component of Oracle E-Business Suite iProcurement, versions 12.2.3 through 12.2.15, reachable over HTTPS; no login or user interaction is required (PR:N/UI:N). The key LIMITING factor is high attack complexity (AC:H) - Oracle rates it 'Difficult to exploit,' indicating the attacker must satisfy a condition outside their control (e.g., winning a race or specific server-side state) rather than firing a single deterministic request. Realistic exposure is further limited because EBS iProcurement is typically deployed on internal or restricted-access enterprise networks rather than the open internet, and only the 12.2.x release line is affected. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.4 (HIGH) is driven by network reach (AV:N), no privileges (PR:N), no user interaction (UI:N) and high confidentiality and integrity impact (C:H/I:H), but it is tempered by high attack complexity (AC:H) - Oracle explicitly labels it 'Difficult to exploit,' meaning the attacker must win a race condition or meet conditions outside their direct control. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so all three exploitation-likelihood signals point low. The signals are internally consistent: a high-impact, unauthenticated, but hard-to-exploit flaw with no evidence of real-world weaponization. Note one tension in the source metadata: the input Tags include 'Authentication Bypass,' yet the description and CVSS (PR:N) describe a flaw that is already pre-authentication rather than a bypass of an auth control - treat the 'Authentication Bypass' characterization as unverified. Net: patch in the normal Oracle CPU cycle; this is not a drop-everything emergency absent new exploitation evidence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches an internet- or intranet-exposed Oracle E-Business Suite iProcurement instance over HTTPS and exploits a flaw in the Internal Operations component that, despite requiring difficult-to-meet conditions (AC:H), lets them read and tamper with critical iProcurement data without logging in. No public exploit code is known at time of analysis, so a working attack would require the adversary to independently develop the exploit against the high-complexity condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unauthenticated network attackers can create, delete, modify, or read critical data in Oracle E-Business Suite iProcurement versions 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTPS. Oracle rates the issue difficult to exploit because of high attack complexity, meaning successful exploitation likely requires a specific server-side condition rather than a single deterministic request. No public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update remediation referenced in the October 2026 advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; the exact patched 12.2.x version or patch level is not specified in the provided data, so confirm the target fix level with Oracle before deployment. Until patching is complete, restrict HTTPS access to iProcurement to trusted enterprise networks or VPN users, which reduces exposure to unauthenticated network attackers but may disrupt remote procurement access. If Internal Operations functionality is not required, disable or tightly restrict the relevant component, accepting the loss of associated procurement features. Monitor and rate-limit anomalous requests to iProcurement Internal Operations endpoints, recognizing that such monitoring may generate false positives and requires tuning.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Internal Operations component of Oracle E-Business Suite iProcurement, an enterprise procurement module typically exposed to internal or restricted-access networks rather than the public internet. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates that no authentication or user interaction is required, but attack complexity is high, so the attacker must satisfy a condition outside their control before the confidentiality and integrity impacts can be realized. The input tags the issue as an Authentication Bypass affecting Oracle, but the specific root-cause weakness class is not disclosed because no CWE is provided. CPE data was not supplied; the confirmed affected range is the 12.2.x release line from 12.2.3 through 12.2.15, with the attack surface being HTTPS access to iProcurement Internal Operations.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable over HTTPS with no auth (AV:N/PR:N) but vendor-rated difficult-to-exploit (AC:H); high confidentiality and integrity impact, no availability effect (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise iProcurement. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all iProcurement accessible data as well as unauthorized access to critical data or complete access to all iProcurement accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite iProcurement versions 12.2.3 through 12.2.15 are exposed to a high-severity flaw in the Internal Operations component that could let network-reachable attackers create, delete, modify, or read critical procurement data. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis; leadership should treat this as a material data-integrity and confidentiality risk until access is constrained and monitoring is in place.
No vendor-released patch identified at time of analysis; restrict HTTPS access to Internal Operations, segment affected iProcurement 12.2.3 through 12.2.15 deployments, add WAF or reverse-proxy filtering, enforce least privilege, monitor procurement data changes, and maintain validated backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB