{"id":"CVE-2026-91222","kind":"vulnerability","aliases":["CVE-2026-91222"],"related":[],"title":"Oracle BPM Suite: low-privilege SOAP request takes over the server","description":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle BPM Suite Human Workflow (11g+) flaw, CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C). A low-privilege user sends a SOAP request and takes over BPM Suite, with scope change to other products on the same middleware. Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed by the October 2026 Critical Patch Update.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Process Management Suite","fixed":["October 2026 CPU patch (exact version unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-bpm","oracle-fusion-middleware","runtime","self-hosted","soap"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Check whether you run Oracle BPM Suite 12.2.1.4.0 or 14.1.2.0.0 (Fusion Middleware): run 'opatch lsinventory' in the Oracle home and compare against the Oct 2026 CPU Fusion Middleware patch set. Exposed if the Human Workflow SOAP endpoints (e.g. /integration/services/TaskQueryService, /integration/services/TaskService) are reachable by any authenticated low-privilege user.","fix":"Apply the October 2026 Oracle Critical Patch Update for Fusion Middleware (Oracle BPM Suite patch listed in the Fusion Middleware Patch Availability Document on My Oracle Support; exact patch number unknown, needs MOS login). No workaround found; until patched, restrict network access to BPM/SOA SOAP endpoints and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:22+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:25+00:00","updated_at":"2026-10-23T23:01:47+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-23T22:34:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle BPM Suite: low-privilege SOAP request takes over the server","impact":"high","summary":"Oracle Business Process Management Suite's Human Workflow component (versions 12.2.1.4.0 and 14.1.2.0.0) has a flaw reachable over SOAP from the network. An attacker with a low-privilege account can take over the product and affect other products on the same middleware.","category":"runtime","who_cares":["oracle-bpm","oracle-fusion-middleware","soap","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the BPM server and reaches other middleware products","analyst_note":"Find Oracle's July-style Critical Patch Update advisory for CVE-2026-91222 to get the patch version and any workaround; the NVD entry gives no fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000503,"input_tokens":3146,"output_tokens":377,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's July-style Critical Patch Update advisory for CVE-2026-91222 to get the patch version and any workaround; the NVD entry gives no fix.","search":"'-2026':14A,17A '-91222':15A,18A '/av':180C '11g':41B,104C '12.2.1.4.0':77B,111C '14.1.2.0.0':79B,113C '2026':84B '3.1':44B,167C,179C '9.9':45B,170C 'access':123C 'addit':147C 'affect':76B,109C 'allow':117C 'attack':120C,143C,152C 'av':46B 'avail':174C 'base':168C 'bpm':2A,26B,37B,64B 'busi':92C,129C,139C,162C 'business':20A 'c':51B 'c/c':185C 'chang':68B,150C 'compon':101C 'compromis':127C 'confidenti':171C 'critic':85B 'cve':13A,16A 'cvss':43B,166C,176C,178C 'easili':114C 'exploit':115C 'fix':80B 'flaw':42B 'fusion':29B,99C 'h':188C 'h/a':187C 'h/i':186C 'host':34B 'human':39B,102C 'impact':146C,175C 'integr':172C 'l/pr':48B,182C 'l/ui':49B,183C 'low':5A,54B,118C 'low-privileg':4A,53B 'manag':94C,131C,141C,164C 'management':22A 'may':144C 'middlewar':30B,75B,100C 'n/ac':47B,181C 'n/s':50B,184C 'network':122C 'octob':83B 'oracl':1A,25B,28B,36B,91C,98C,128C,138C,161C 'oracle':19A 'oracle-bpm':24B 'oracle-fusion-middlewar':27B 'patch':86B 'privileg':6A,55B,119C 'process':21A,93C,130C,140C,163C 'product':71B,96C,148C 'request':8A,60B 'result':157C 'runtim':31B 'scope':67B,149C 'score':169C 'self':33B 'self-host':32B 'send':57B 'server':12A 'signific':145C 'soap':7A,35B,59B,125C 'success':151C 'suit':3A,38B,65B,95C,132C,142C,165C 'suite':23A 'support':105C 'take':9A,62B 'takeov':159C 'updat':87B 'user':56B 'vector':177C 'version':106C 'via':124C 'vulner':88C,116C,135C,155C 'workflow':40B,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91222","severity":null,"published_at":"2026-10-20T22:20:22+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91222:352","url":null,"severity":null,"published_at":"2026-10-23T23:01:47+00:00","modified_at":"2026-10-23T23:01:47+00:00","first_seen_at":"2026-10-23T23:01:47+00:00","fetched_at":"2026-10-23T23:01:47+00:00","note":"Fixed in Oracle CPU October 2026 (cpuoct2026, 2026-10-19), Fusion Middleware patch doc; exact patch number is in a login-walled MOS doc, not read. No exploitation or PoC found (VulDB: no exploit). Did not search X/social."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1733,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91222","title":"CVE Record: CVE-2026-91222","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}