{"id":"CVE-2026-91358","kind":"vulnerability","aliases":["CVE-2026-91358"],"related":[],"title":"Oracle BPM Suite: unauthenticated HTTP flaw exposes critical data in Case Management","description":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","summary":"Oracle Business Process Management Suite's Case Management Service, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over HTTP without logging in. An attacker can read critical data and modify or delete some of the data the suite can access.","severity":"high","cvss":8.2,"epss":0.00339,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-bpm","oracle-fusion-middleware","package"],"not_affected_if":["bpm-not-deployed"],"how_to_check":"- Check the installed Oracle BPM Suite version against `12.2.1.4.0` and `14.1.2.0.0`\n- Confirm whether the Case Management Service is deployed and reachable over HTTP","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Business Process Management Suite (the sources do not name the patched version)\n- Restrict network access to the Case Management Service until patched","status":"open","published_at":"2026-10-20T22:20:38+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:03:57+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:03:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Business Process Management Suite (the sources do not name the patched version)\n- Restrict network access to the Case Management Service until patched","reach":"internet","title":"Oracle BPM Suite: unauthenticated HTTP flaw exposes critical data in Case Management","impact":"high","summary":"Oracle Business Process Management Suite's Case Management Service, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over HTTP without logging in. An attacker can read critical data and modify or delete some of the data the suite can access.","category":"package","nicknames":[],"who_cares":["oracle-bpm","oracle-fusion-middleware","java"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads critical data and alters or deletes some records","analyst_note":"Check the Oracle Critical Patch Update advisory for the patched version and whether Case Management Service is enabled by default.","how_to_check":"- Check the installed Oracle BPM Suite version against `12.2.1.4.0` and `14.1.2.0.0`\n- Confirm whether the Case Management Service is deployed and reachable over HTTP","needs_analyst":true,"not_affected_if":["bpm-not-deployed"],"who_is_affected":"Teams running Oracle Business Process Management Suite 12.2.1.4.0 or 14.1.2.0.0 with the Case Management Service exposed over HTTP. The sources do not say whether the service is on by default, so systems without BPM Suite can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3531,"output_tokens":592,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91358':15A,18A '/av':171C '11g':86C '12.2.1.4.0':39B,93C '14.1.2.0.0':41B,95C '3.1':159C,170C '8.2':162C 'access':68B,104C,123C,129C,137C,147C,156C 'affect':91C 'allow':99C 'attack':52B,101C,115C 'base':160C 'bpm':2A,22B 'busi':29B,73C,110C,133C,152C 'case':11A,34B,83C 'complet':128C 'compon':82C 'compromis':108C 'confidenti':163C 'critic':8A,55B,125C 'cve':13A,16A 'cvss':158C,167C,169C 'data':9A,56B,64B,126C,138C,157C 'delet':60B,146C 'easili':96C 'exploit':97C 'expos':7A 'flaw':6A,44B 'fusion':25B,80C 'h/i':177C 'http':5A,47B,106C 'impact':166C 'insert':144C 'integr':165C 'java':19B 'l/a':178C 'l/pr':173C 'log':49B 'manag':12A,31B,35B,75C,84C,112C,135C,154C 'middlewar':26B,81C 'modifi':58B 'n':179C 'n/ac':172C 'n/s':175C 'n/ui':174C 'network':103C 'oracl':1A,21B,24B,28B,72C,79C,109C,132C,151C 'oracle-bpm':20B 'oracle-fusion-middlewar':23B 'packag':27B 'process':30B,74C,111C,134C,153C 'product':77C 'reachabl':45B 'read':54B 'result':120C 'score':161C 'servic':36B,85C 'success':114C 'suit':3A,32B,66B,76C,113C,136C,155C 'support':87C 'u/c':176C 'unauthent':4A,100C 'unauthor':122C,142C 'updat':143C 'vector':168C 'version':38B,88C 'via':105C 'vulner':69C,98C,118C 'well':140C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Business Process Management Suite 12.2.1.4.0 or 14.1.2.0.0 with the Case Management Service exposed over HTTP. The sources do not say whether the service is on by default, so systems without BPM Suite can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91358","severity":null,"published_at":"2026-10-20T22:20:38+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91358","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91358","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}