---
id: "CVE-2026-91213"
kind: "vulnerability"
aliases: ["CVE-2026-91213"]
title: "Oracle BPM Suite: BPM Composer flaw lets low-privilege users take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Business Process Management Suite", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bpm-composer", "oracle-bpm", "oracle-fusion-middleware", "runtime", "self-hosted"]
not_affected_if: ["bpm-composer-not-deployed", "not-installed", "unknown"]
published_at: "2026-10-20T22:20:21+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:59:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91213", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:59:20+00:00"}]
---

# Oracle BPM Suite: BPM Composer flaw lets low-privilege users take over server

Oracle Business Process Management Suite's BPM Composer component has a flaw that a low-privilege user can reach over HTTP from the network. A successful attack gives the attacker full control of the BPM Suite server, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Business Process Management Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed ?

## How to check

Check whether Oracle BPM Suite is installed in your Oracle Fusion Middleware home at 12.2.1.4.0 or 14.1.2.0.0 (run OPatch lsinventory and look for the BPM Suite product). Compare the installed patches with the October 2026 CPU patch for Fusion Middleware. Check whether the BPM Composer web app is deployed and reachable over HTTP. Whether a disabled Composer avoids the flaw is not confirmed.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware (Oracle BPM Suite). The exact patch number is in the Fusion Middleware patch availability document on My Oracle Support (unknown, login required). Until patched, restrict network access to BPM Composer and review which accounts can log in to it.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91213
- 2026-10-23T23:59:20+00:00 analyst — Listed in Oracle CPU Oct 2026 (20 Oct) under Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0, Fusion Middleware patch doc. Fixed build numbers are in the My Oracle Support patch document (login required), not read. Whether BPM Composer must be enabled is not stated in public sources. No exploitation or PoC found.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91213 https://www.cve.org/CVERecord?id=CVE-2026-91213

## From the sources

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_