Oracle BPM Suite Critical Flaw Allows Remote Takeover via SOAP
A critical vulnerability in Oracle Business Process Management Suite enables remote attackers to seize control of the system with low privileges.
Key points
- CVE-2026-91222 carries a CVSS 9.9 score, indicating critical severity.
- The flaw affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0.
- Attackers can exploit the issue via SOAP with network access and low privileges.
The National Vulnerability Database has recorded a critical security flaw in Oracle Business Process Management Suite that allows remote attackers to take over the software. The vulnerability, identified as CVE-2026-91222, poses a severe risk to organizations using specific versions of the Oracle Fusion Middleware product line.
This easily exploitable weakness enables a low-privileged attacker with network access to compromise the system via SOAP. According to the NVD record, successful exploitation results in full takeover of the Oracle Business Process Management Suite. The CVSS 3.1 base score is 9.9, reflecting high impacts on confidentiality, integrity, and availability.
Scope and Impact Analysis
The vulnerability resides within the Human Workflow component of the Oracle Business Process Management Suite. While the flaw is specific to this component, the NVD notes that attacks may significantly impact additional products due to scope change. This means the breach could extend beyond the initial target, affecting other connected systems or data stores within the organization's infrastructure.
The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates that the attack vector is network-based and requires low complexity. No user interaction is needed for the exploit to succeed. The scope change flag suggests that the attacker gains access to resources beyond the vulnerable component, amplifying the potential damage.
Affected Versions and Components
Only specific supported versions of the Oracle Business Process Management Suite are affected by this critical vulnerability. The NVD record explicitly lists versions 12.2.1.4.0 and 14.1.2.0.0 as vulnerable. Organizations running these exact versions of the Human Workflow component within Oracle Fusion Middleware are at immediate risk.
Other versions of the Oracle Business Process Management Suite or other Oracle Fusion Middleware products are not listed as affected in this specific advisory. However, due to the scope change nature of the vulnerability, administrators should verify if their environment includes interdependencies with the affected Human Workflow component.
What should you do?
Security teams should immediately audit their environments to identify if they are running the affected versions of Oracle Business Process Management Suite. If the vulnerable versions are present, restrict network access to the SOAP endpoints as a temporary mitigation. Monitor for unusual activity that might indicate an attempt to exploit the low-privilege access vector.
What to do and how to stay safe: Oracle
- Inventory all instances of Oracle Business Process Management Suite to check for versions 12.2.1.4.0 and 14.1.2.0.0.
- Restrict network access to SOAP endpoints to limit exposure to untrusted networks.
- Monitor logs for unusual SOAP traffic or privilege escalation attempts.
- Await vendor confirmation for patches once Oracle releases an update.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91222?
The CVSS 3.1 base score is 9.9, which is rated as critical.
Which versions of Oracle Business Process Management Suite are affected?
Versions 12.2.1.4.0 and 14.1.2.0.0 are affected by this vulnerability.
Can a low-privileged attacker exploit this flaw?
Yes, a low-privileged attacker with network access via SOAP can exploit it.
