{"id":"CVE-2026-91243","kind":"vulnerability","aliases":["CVE-2026-91243"],"related":[],"title":"Oracle BPM Suite: low-privileged HTTP user can read and change data","description":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","summary":"Oracle Business Process Management Suite (Fusion Middleware, Fabric Layer) 12.2.1.4.0 and 14.1.2.0.0: a low-privileged user with HTTP access can read, create, modify and delete BPM-accessible data, with scope change. CVSS 3.1 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Process Management Suite","fixed":["Oct 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","oracle","oracle-bpm","oracle-fusion-middleware","self-hosted","vendor"],"not_affected_if":["auth-required"],"how_to_check":"You are exposed if you run Oracle BPM Suite 12.2.1.4.0 or 14.1.2.0.0 without the October 2026 CPU patch. Run OPatch lsinventory in the Oracle home and compare against the patch listed for Fusion Middleware in the Oct 2026 CPU patch availability document (My Oracle Support).","fix":"Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware (BPM Suite). The exact patch number is in the MOS patch availability document, which was not read. Interim: limit network access to BPM endpoints to trusted hosts only (workaround suggested by Armis, not by Oracle).","status":"open","published_at":"2026-10-20T22:20:25+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:14+00:00","updated_at":"2026-10-23T22:59:40+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T22:34:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle BPM Suite: low-privileged HTTP user can read and change data","impact":"high","summary":"Oracle Business Process Management Suite's Fabric Layer, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack gives unauthorized create, read, update and delete access to data the suite can reach, and can extend beyond the product (scope change).","category":"vendor","who_cares":["oracle-bpm","oracle-fusion-middleware","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads and modifies critical BPM data and may reach other products","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91243 to get the patch version and any workaround; the NVD entry does not list one.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000516,"input_tokens":3196,"output_tokens":392,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-91243 to get the patch version and any workaround; the NVD entry does not list one.","search":"'-2026':15A,18A '-91243':16A,19A '/av':216C '12.2.1.4.0':47B,117C '14.1.2.0.0':49B,119C '2026':88B '3.1':72B,204C,215C '9.6':73B,207C 'access':57B,66B,129C,170C,181C,187C,193C,201C 'addit':153C 'affect':115C 'allow':123C 'attack':126C,149C,158C 'av':74B 'base':205C 'bpm':2A,29B,65B 'bpm-access':64B 'busi':39B,99C,135C,145C,177C,197C 'business':21A 'c/c':79B,221C 'chang':12A,70B,156C 'complet':192C 'compon':108C 'compromis':133C 'confidenti':208C 'creat':60B 'creation':166C 'critic':89B,172C,189C 'cve':14A,17A 'cvss':71B,203C,212C,214C 'data':13A,67B,173C,182C,190C,202C 'delet':63B,167C 'easili':120C 'exploit':94B,121C 'fabric':45B,109C 'fix':83B 'fusion':32B,43B,106C 'h/a':81B,223C 'h/i':80B,222C 'host':36B 'http':7A,56B,131C 'impact':152C,211C 'integr':210C 'java':25B 'known':93B 'l/pr':76B,218C 'l/ui':77B,219C 'layer':46B,110C 'low':5A,52B,124C 'low-privileg':4A,51B 'manag':41B,101C,137C,147C,179C,199C 'management':23A 'may':150C 'middlewar':33B,44B,107C 'modif':169C 'modifi':61B 'n':82B,224C 'n/ac':75B,217C 'n/s':78B,220C 'network':128C 'octob':87B 'oracl':1A,26B,28B,31B,38B,85B,98C,105C,134C,144C,176C,196C 'oracle':20A 'oracle-bpm':27B 'oracle-fusion-middlewar':30B 'patch':90B 'privileg':6A,53B,125C 'process':22A,40B,100C,136C,146C,178C,198C 'product':103C,154C 'read':10A,59B 'result':163C 'scope':69B,155C 'score':206C 'self':35B 'self-host':34B 'signific':151C 'success':157C 'suit':3A,42B,102C,138C,148C,180C,200C 'suite':24A 'support':111C 'unauthor':165C,186C 'updat':91B 'user':8A,54B 'vector':213C 'vendor':37B 'version':112C 'via':130C 'vulner':95C,122C,141C,161C 'well':184C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91243","severity":null,"published_at":"2026-10-20T22:20:25+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91243:342","url":null,"severity":null,"published_at":"2026-10-23T22:59:40+00:00","modified_at":"2026-10-23T22:59:40+00:00","first_seen_at":"2026-10-23T22:59:40+00:00","fetched_at":"2026-10-23T22:59:40+00:00","note":"Oracle CPU Oct 2026 (Oct 20) lists BPM Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware patch doc; CVSS 9.6 per CVE record. Exact patch number is behind My Oracle Support, not read. No exploitation or PoC found (Armis, OpenCVE: KEV no). Did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1717,"url":"https://cve.armis.com/CVE-2026-91243","title":"Armis: CVE-2026-91243","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1718,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91243","title":"CVE Record: CVE-2026-91243","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}