{"id":"CVE-2026-91220","kind":"vulnerability","aliases":["CVE-2026-91220"],"related":[],"title":"Oracle BPM Human Workflow: unauthenticated network attacker can take over server","description":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle BPM Suite Human Workflow flaw (CVSS 3.1 9.8, AV:N/PR:N/UI:N) lets an unauthenticated attacker reach the product over HTTP and take it over. It affects 12.2.1.4.0 and 14.1.2.0.0. Oracle fixed it in the October 2026 Critical Patch Update, which also fixes related BPM Human Workflow CVEs (CVE-2026-91222 and CVE-2026-47065).","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Process Management Suite","fixed":["Oracle CPU October 2026 patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["http","oracle-bpm","oracle-fusion-middleware","runtime","self-hosted"],"not_affected_if":["managed-hosting","other-versions"],"how_to_check":"Find the installed BPM Suite version and CPU patch level: run 'opatch lsinventory' in the Oracle home and look for the Oct 2026 Fusion Middleware CPU patch for BPM. Versions 12.2.1.4.0 and 14.1.2.0.0 without it are exposed. Exposure is highest if the SOA/BPM managed server's Human Workflow HTTP endpoints are reachable from untrusted networks.","fix":"Apply the Oracle October 2026 CPU patch for Oracle Business Process Management Suite, using the Fusion Middleware Patch Availability Document on My Oracle Support. Patch number: unknown, because the doc needs a login. Until then, block network access to the BPM/SOA managed server from untrusted networks.","status":"open","published_at":"2026-10-20T22:20:22+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:30+00:00","updated_at":"2026-10-23T23:02:56+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:34:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle BPM Human Workflow: unauthenticated network attacker can take over server","impact":"high","summary":"Oracle Business Process Management Suite (Human Workflow component) versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets an unauthenticated attacker reach the product over HTTP. A successful attack gives the attacker full takeover of the server, with confidentiality, integrity and availability all affected.","category":"runtime","who_cares":["oracle-bpm","oracle-fusion-middleware","self-hosted","http"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over the server over HTTP without logging in","analyst_note":"Find Oracle's security alert or patch for CVE-2026-91220 to get the fixed version and patch name; the sources do not give either.","how_to_check":"Check whether the installed Oracle BPM Suite version is 12.2.1.4.0 or 14.1.2.0.0.\nunknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000902,"input_tokens":3099,"output_tokens":1185,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's security alert or patch for CVE-2026-91220 to get the fixed version and patch name; the sources do not give either.","search":"'-2026':13A,16A,85B,89B '-47065':90B '-91220':14A,17A '-91222':86B '/av':163C '12.2.1.4.0':63B,113C '14.1.2.0.0':65B,115C '2026':72B '3.1':42B,150C,162C '9.8':43B,153C 'access':124C 'affect':62B,111C 'allow':119C 'also':77B 'attack':7A,51B,121C,135C 'av':44B 'avail':157C 'base':151C 'bpm':2A,26B,36B,80B 'busi':95C,130C,145C 'business':19A 'compon':104C 'compromis':128C 'confidenti':154C 'critic':73B 'cve':12A,15A,84B,88B 'cves':83B 'cvss':41B,149C,159C,161C 'easili':116C 'exploit':117C 'fix':67B,78B 'flaw':40B 'fusion':29B,102C 'h':171C 'h/a':170C 'h/i':169C 'host':34B 'http':23B,56B,126C 'human':3A,38B,81B,105C 'impact':158C 'integr':155C 'l/pr':165C 'let':48B 'manag':97C,132C,147C 'management':21A 'middlewar':30B,103C 'n':47B 'n/ac':164C 'n/pr':45B 'n/s':167C 'n/ui':46B,166C 'network':6A,123C 'octob':71B 'oracl':1A,25B,28B,35B,66B,94C,101C,129C,144C 'oracle':18A 'oracle-bpm':24B 'oracle-fusion-middlewar':27B 'patch':74B 'process':20A,96C,131C,146C 'product':54B,99C 'reach':52B 'relat':79B 'result':140C 'runtim':31B 'score':152C 'self':33B 'self-host':32B 'server':11A 'success':134C 'suit':37B,98C,133C,148C 'suite':22A 'support':107C 'take':9A,58B 'takeov':142C 'u/c':168C 'unauthent':5A,50B,120C 'updat':75B 'vector':160C 'version':108C 'via':125C 'vulner':91C,118C,138C 'workflow':4A,39B,82B,106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91220","severity":null,"published_at":"2026-10-20T22:20:22+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91220:354","url":null,"severity":null,"published_at":"2026-10-23T23:02:56+00:00","modified_at":"2026-10-23T23:02:56+00:00","first_seen_at":"2026-10-23T23:02:56+00:00","fetched_at":"2026-10-23T23:02:56+00:00","note":"Fixed in Oracle CPU October 2026 (published 2026-10-20), listed under Fusion Middleware for BPM Suite 12.2.1.4.0 and 14.1.2.0.0. The exact patch number and name are in the My Oracle Support patch availability doc, which needs a login, so they are unknown. No public PoC or exploitation in Tenable or Rapid7. I did not search X or other social sources."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1747,"url":"https://www.tenable.com/plugins/nessus/370445","title":"Tenable plugin 370445: Oracle BPM Suite (October 2026 CPU)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1749,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-91220/","title":"Rapid7 DB: CVE-2026-91220","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}