Oracle BPM Suite Faces Critical Remote Code Execution Flaw CVE-2026-91220

The National Vulnerability Database has published details for CVE-2026-91220, a critical vulnerability in Oracle Business Process Management Suite. This flaw allows an unauthenticated attacker with network access to compromise the system entirely through HTTP requests, posing an immediate threat to organizations using the affected software.

According to the NVD record, the issue resides within the Human Workflow component of Oracle Fusion Middleware. Successful exploitation of this vulnerability results in a complete takeover of the Oracle Business Process Management Suite. The attack requires no user interaction and no prior authentication, making it easily exploitable for any actor with network access to the service.

Severity and Technical Context

The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.8 to this vulnerability, classifying it as critical. The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates high impacts on confidentiality, integrity, and availability. Attackers can achieve this compromise with low complexity and without needing any privileges or user interaction.

This rating reflects the ease with which an attacker can gain control over the system. The combination of network accessibility and lack of authentication requirements means that exposed instances are vulnerable to automated scanning and exploitation. The high impact on all three security pillars suggests that data theft, system modification, and service disruption are all potential outcomes.

Affected Versions and Scope

The vulnerability specifically impacts two supported versions of Oracle Business Process Management Suite: 12.2.1.4.0 and 14.1.2.0.0. Organizations running these specific releases of the Human Workflow component are directly exposed to the risk described in CVE-2026-91220. No other versions are listed as affected in the current NVD record.

Users of Oracle Fusion Middleware should verify their current installation versions immediately. The narrow scope of affected versions allows for precise identification of at-risk systems. However, the ease of exploitation means that any unpatched instance of these versions connected to a network is a potential target for remote compromise.

What should you do?

Security teams should audit their environments to identify any instances of Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0. Since the vulnerability is easily exploitable via HTTP, isolating these systems from untrusted networks is a critical immediate step. Organizations should monitor for unauthorized access attempts or unusual HTTP traffic targeting the Human Workflow component.

What to do and how to stay safe: Oracle

• Inventory all systems running Oracle Business Process Management Suite to check for versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict network access to the Human Workflow component to trusted internal networks only, blocking external HTTP access.
• Monitor server logs for suspicious HTTP requests or unusual activity targeting the affected component.
• Prepare to apply patches once the vendor releases an official update for CVE-2026-91220.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-91220?

It is a critical vulnerability in Oracle Business Process Management Suite that allows unauthenticated remote takeover via HTTP.

Which versions of Oracle BPM Suite are affected?

Versions 12.2.1.4.0 and 14.1.2.0.0 of the Human Workflow component are affected.

How severe is this vulnerability?

The National Vulnerability Database rates it as critical with a CVSS score of 9.8.