---
id: "CVE-2026-91220"
kind: "vulnerability"
aliases: ["CVE-2026-91220"]
title: "Oracle BPM Human Workflow: unauthenticated network attacker can take over server"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Business Process Management Suite", "fixed": ["Oracle CPU October 2026 patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["http", "oracle-bpm", "oracle-fusion-middleware", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "other-versions"]
published_at: "2026-10-20T22:20:22+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:02:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91220", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:02:56+00:00"}]
---

# Oracle BPM Human Workflow: unauthenticated network attacker can take over server

Oracle BPM Suite Human Workflow flaw (CVSS 3.1 9.8, AV:N/PR:N/UI:N) lets an unauthenticated attacker reach the product over HTTP and take it over. It affects 12.2.1.4.0 and 14.1.2.0.0. Oracle fixed it in the October 2026 Critical Patch Update, which also fixes related BPM Human Workflow CVEs (CVE-2026-91222 and CVE-2026-47065).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Business Process Management Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed Oracle CPU October 2026 patch (number unknown)

## How to check

Find the installed BPM Suite version and CPU patch level: run 'opatch lsinventory' in the Oracle home and look for the Oct 2026 Fusion Middleware CPU patch for BPM. Versions 12.2.1.4.0 and 14.1.2.0.0 without it are exposed. Exposure is highest if the SOA/BPM managed server's Human Workflow HTTP endpoints are reachable from untrusted networks.

## Fix

Apply the Oracle October 2026 CPU patch for Oracle Business Process Management Suite, using the Fusion Middleware Patch Availability Document on My Oracle Support. Patch number: unknown, because the doc needs a login. Until then, block network access to the BPM/SOA managed server from untrusted networks.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91220
- 2026-10-23T23:02:56+00:00 analyst — Fixed in Oracle CPU October 2026 (published 2026-10-20), listed under Fusion Middleware for BPM Suite 12.2.1.4.0 and 14.1.2.0.0. The exact patch number and name are in the My Oracle Support patch availability doc, which needs a login, so they are unknown. No public PoC or exploitation in Tenable or Rapid7. I did not search X or other social sources.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Rapid7 DB: CVE-2026-91220 https://www.rapid7.com/db/vulnerabilities/cve-2026-91220/
- [mentions] Tenable plugin 370445: Oracle BPM Suite (October 2026 CPU) https://www.tenable.com/plugins/nessus/370445

## From the sources

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_