CVE-2026-91337 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle E-Business Suite and iProcurement deployments, particularly those using versions 12.2.3-12.2.15, should assess exposure and prioritize remediation.

Why it matters

Defenders should prioritize verifying exposure of iProcurement versions 12.2.3-12.2.15, assessing network access controls, and monitoring for suspicious activity due to the high-severity vulnerability allowing potential unauthorized data access and modification.

• Potential unauthorized creation, deletion, or modification of critical data or all iProcurement accessible data
• Potential unauthorized access to critical data or complete access to all iProcurement accessible data
• Requires verification of iProcurement version and exposure
• Prioritization of remediation based on CVSS 3.1 Base Score of 7.4

Technical summary

The vulnerability in Oracle E-Business Suite's iProcurement component (Internal operations) affects versions 12.2.3-12.2.15. It has a CVSS 3.1 Base Score of 7.4, indicating high severity. The vulnerability allows unauthenticated attackers with network access via HTTPS to compromise iProcurement, potentially leading to unauthorized creation, deletion, or modification of critical data or all iProcurement accessible data, as well as unauthorized access to critical data or complete access to all iProcurement accessible data.

Defensive priority

Defenders should prioritize verifying exposure of iProcurement versions 12.2.3-12.2.15, assessing network access controls, and monitoring for suspicious activity.

Recommended defensive actions

• Verify iProcurement version and exposure
• Assess network access controls
• Monitor for suspicious activity
• Review and apply Oracle's security patches
• Track exceptions and retest remediated assets
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert also provides relevant information. Defenders should verify iProcurement version and exposure, assess network access controls, and monitor for suspicious activity due to the high-severity vulnerability allowing potential unauthorized data access and modification. The vulnerability affects iProcurement versions 12.2.3-12.2.15, and its CVSS 3.1 Base Score is 7.4, indicating high severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.