{"id":"CVE-2026-91213","kind":"vulnerability","aliases":["CVE-2026-91213"],"related":[],"title":"Oracle BPM Suite: BPM Composer flaw lets low-privilege users take over server","description":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Business Process Management Suite's BPM Composer component has a flaw that a low-privilege user can reach over HTTP from the network. A successful attack gives the attacker full control of the BPM Suite server, with high confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Process Management Suite","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["bpm-composer","oracle-bpm","oracle-fusion-middleware","runtime","self-hosted"],"not_affected_if":["bpm-composer-not-deployed","not-installed","unknown"],"how_to_check":"Check whether Oracle BPM Suite is installed in your Oracle Fusion Middleware home at 12.2.1.4.0 or 14.1.2.0.0 (run OPatch lsinventory and look for the BPM Suite product). Compare the installed patches with the October 2026 CPU patch for Fusion Middleware. Check whether the BPM Composer web app is deployed and reachable over HTTP. Whether a disabled Composer avoids the flaw is not confirmed.","fix":"Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware (Oracle BPM Suite). The exact patch number is in the Fusion Middleware patch availability document on My Oracle Support (unknown, login required). Until patched, restrict network access to BPM Composer and review which accounts can log in to it.","status":"open","published_at":"2026-10-20T22:20:21+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:31+00:00","updated_at":"2026-10-23T23:59:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to a patched release per Oracle's advisory for the affected versions 12.2.1.4.0 and 14.1.2.0.0; the sources do not name the fixed build.","reach":"network","title":"Oracle BPM Suite: BPM Composer flaw lets low-privilege users take over server","impact":"high","summary":"Oracle Business Process Management Suite's BPM Composer component has a flaw that a low-privilege user can reach over HTTP from the network. A successful attack gives the attacker full control of the BPM Suite server, with high confidentiality, integrity and availability impact.","category":"runtime","who_cares":["oracle-bpm","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the BPM Suite server and reads, changes or disrupts data","analyst_note":"Find the fixed build numbers and the Oracle Critical Patch Update advisory that lists CVE-2026-91213, and confirm whether BPM Composer must be enabled to be exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00053,"input_tokens":3097,"output_tokens":441,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed build numbers and the Oracle Critical Patch Update advisory that lists CVE-2026-91213, and confirm whether BPM Composer must be enabled to be exposed.","search":"'-2026':16A,19A '-91213':17A,20A '/av':158C '12.2.1.4.0':107C '14.1.2.0.0':109C '3.1':145C,157C '8.8':148C 'access':119C 'affect':105C 'allow':113C 'attack':67B,70B,116C,130C 'avail':83B,152C 'base':146C 'bpm':2A,4A,27B,31B,46B,75B,99C 'bpm-compos':26B 'busi':41B,89C,125C,140C 'business':22A 'compon':48B,98C 'compos':5A,28B,47B,100C 'compromis':123C 'confidenti':80B,149C 'control':72B 'cve':15A,18A 'cvss':144C,154C,156C 'easili':110C 'exploit':111C 'flaw':6A,51B 'full':71B 'fusion':34B,96C 'give':68B 'h':166C 'h/a':165C 'h/i':164C 'high':79B 'host':39B 'http':61B,121C 'impact':84B,153C 'integr':81B,150C 'l/pr':160C 'l/ui':161C 'let':7A 'low':9A,55B,114C 'low-privileg':8A,54B 'manag':43B,91C,127C,142C 'management':24A 'middlewar':35B,97C 'n/ac':159C 'n/s':162C 'network':64B,118C 'oracl':1A,30B,33B,40B,88C,95C,124C,139C 'oracle':21A 'oracle-bpm':29B 'oracle-fusion-middlewar':32B 'privileg':10A,56B,115C 'process':23A,42B,90C,126C,141C 'product':93C 'reach':59B 'result':135C 'runtim':36B 'score':147C 'self':38B 'self-host':37B 'server':14A,77B 'success':66B,129C 'suit':3A,44B,76B,92C,128C,143C 'suite':25A 'support':101C 'take':12A 'takeov':137C 'u/c':163C 'user':11A,57B 'vector':155C 'version':102C 'via':120C 'vulner':85C,112C,133C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91213","severity":null,"published_at":"2026-10-20T22:20:21+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91213:562","url":null,"severity":null,"published_at":"2026-10-23T23:59:20+00:00","modified_at":"2026-10-23T23:59:20+00:00","first_seen_at":"2026-10-23T23:59:20+00:00","fetched_at":"2026-10-23T23:59:20+00:00","note":"Listed in Oracle CPU Oct 2026 (20 Oct) under Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0, Fusion Middleware patch doc. Fixed build numbers are in the My Oracle Support patch document (login required), not read. Whether BPM Composer must be enabled is not stated in public sources. No exploitation or PoC found."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2290,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91213","title":"CVE Record: CVE-2026-91213","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}