---
id: "CVE-2026-91243"
kind: "vulnerability"
aliases: ["CVE-2026-91243"]
title: "Oracle BPM Suite: low-privileged HTTP user can read and change data"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Business Process Management Suite", "fixed": ["Oct 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "oracle", "oracle-bpm", "oracle-fusion-middleware", "self-hosted", "vendor"]
not_affected_if: ["auth-required"]
published_at: "2026-10-20T22:20:25+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T22:59:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91243", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:59:40+00:00"}]
---

# Oracle BPM Suite: low-privileged HTTP user can read and change data

Oracle Business Process Management Suite (Fusion Middleware, Fabric Layer) 12.2.1.4.0 and 14.1.2.0.0: a low-privileged user with HTTP access can read, create, modify and delete BPM-accessible data, with scope change. CVSS 3.1 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Business Process Management Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed Oct 2026 CPU patch (number unknown)

## How to check

You are exposed if you run Oracle BPM Suite 12.2.1.4.0 or 14.1.2.0.0 without the October 2026 CPU patch. Run OPatch lsinventory in the Oracle home and compare against the patch listed for Fusion Middleware in the Oct 2026 CPU patch availability document (My Oracle Support).

## Fix

Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware (BPM Suite). The exact patch number is in the MOS patch availability document, which was not read. Interim: limit network access to BPM endpoints to trusted hosts only (workaround suggested by Armis, not by Oracle).

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91243
- 2026-10-23T22:59:40+00:00 analyst — Oracle CPU Oct 2026 (Oct 20) lists BPM Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware patch doc; CVSS 9.6 per CVE record. Exact patch number is behind My Oracle Support, not read. No exploitation or PoC found (Armis, OpenCVE: KEV no). Did not search social posts.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91243 https://www.cve.org/CVERecord?id=CVE-2026-91243
- [mentions] Armis: CVE-2026-91243 https://cve.armis.com/CVE-2026-91243

## From the sources

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_