Unauthenticated Takeover Flaw in Oracle BPM Suite Hits Specific Versions

A severe vulnerability has been identified in Oracle Business Process Management Suite, specifically within the Human Workflow component of Oracle Fusion Middleware. This vulnerability, designated CVE-2026-91220, allows unauthenticated attackers to compromise the system entirely, resulting in takeover of the application.

What happened

The National Vulnerability Database records CVE-2026-91220 as a critical vulnerability with a base score of 9.8. The flaw resides in the Human Workflow component of the Oracle Business Process Management Suite product. This component is part of the broader Oracle Fusion Middleware family.

According to the NVD record, supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected by this issue. The vulnerability is described as easily exploitable. An attacker does not need to authenticate to the system to trigger the exploit. Network access via HTTP is sufficient to initiate the attack vector.

Successful exploitation results in the takeover of the Oracle Business Process Management Suite. The CVSS vector indicates high impacts on confidentiality, integrity, and availability. The attack complexity is rated as low, and no user interaction is required. The scope of the attack is unchanged, meaning the vulnerability affects the same privileges as the attacker.

Why it matters

Environments running the specified versions of Oracle BPM Suite are exposed to immediate risk. Because the attack requires no authentication, any system reachable via HTTP from the internet or internal network segments is a potential target. Security teams must verify their inventory for versions 12.2.1.4.0 and 14.1.2.0.0.

The high CVSS score reflects the severity of the potential impact. Attackers can take over the entire suite, potentially leading to data theft or lateral movement within the network. The ease of exploitation increases the likelihood of widespread abuse. Organizations relying on these middleware components for business process automation face significant operational risk.

Our take on the response

• Identify all instances of Oracle BPM Suite versions 12.2.1.4.0 and 14.1.2.0.0 in your environment.
• Implement network access controls to restrict HTTP traffic to these systems.
• Monitor for unusual HTTP requests targeting the Human Workflow component.
• Prepare an incident response plan for potential compromise of these services.

What defenders should look for

Teams should monitor web server logs for unauthorized access attempts to the Human Workflow endpoints. Look for unusual HTTP POST requests that do not originate from known authenticated users. Check for signs of system compromise such as new processes or outbound connections from the BPM Suite servers. Verify that no unexpected changes have been made to the application configuration.

Background: Unauthorized access

Most teams assume unauthorized access means broken encryption or stolen passwords. In reality, attackers often use valid accounts, legitimate tools, and internal trust relationships. Detection fails because alerts are tuned to look for outsiders, not insiders acting strangely.

Read the full guide: Unauthorized Access Myths: What Detection Actually Misses

What to do and how to stay safe: Oracle

• Audit your current installations of Oracle Business Process Management Suite to confirm versions.
• Restrict network access to the affected systems to trusted IP addresses only.
• Enable detailed logging on web servers to capture all HTTP requests.
• Watch for alerts related to unauthorized access or privilege escalation.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle products are affected by CVE-2026-91220?

Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0.

What is the CVSS score for this vulnerability?

The CVSS 3.1 Base Score is 9.8, classified as critical.

Does an attacker need credentials to exploit this flaw?

No, the vulnerability allows unauthenticated attackers with network access via HTTP to exploit it.