---
id: "CVE-2026-91222"
kind: "vulnerability"
aliases: ["CVE-2026-91222"]
title: "Oracle BPM Suite: low-privilege SOAP request takes over the server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Business Process Management Suite", "fixed": ["October 2026 CPU patch (exact version unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-bpm", "oracle-fusion-middleware", "runtime", "self-hosted", "soap"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T22:20:22+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:01:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91222", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:01:47+00:00"}]
---

# Oracle BPM Suite: low-privilege SOAP request takes over the server

Oracle BPM Suite Human Workflow (11g+) flaw, CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C). A low-privilege user sends a SOAP request and takes over BPM Suite, with scope change to other products on the same middleware. Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed by the October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Business Process Management Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (exact version unknown)

## How to check

Check whether you run Oracle BPM Suite 12.2.1.4.0 or 14.1.2.0.0 (Fusion Middleware): run 'opatch lsinventory' in the Oracle home and compare against the Oct 2026 CPU Fusion Middleware patch set. Exposed if the Human Workflow SOAP endpoints (e.g. /integration/services/TaskQueryService, /integration/services/TaskService) are reachable by any authenticated low-privilege user.

## Fix

Apply the October 2026 Oracle Critical Patch Update for Fusion Middleware (Oracle BPM Suite patch listed in the Fusion Middleware Patch Availability Document on My Oracle Support; exact patch number unknown, needs MOS login). No workaround found; until patched, restrict network access to BPM/SOA SOAP endpoints and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91222
- 2026-10-23T23:01:47+00:00 analyst — Fixed in Oracle CPU October 2026 (cpuoct2026, 2026-10-19), Fusion Middleware patch doc; exact patch number is in a login-walled MOS doc, not read. No exploitation or PoC found (VulDB: no exploit). Did not search X/social.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91222 https://www.cve.org/CVERecord?id=CVE-2026-91222

## From the sources

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_