---
id: "CVE-2026-91358"
kind: "vulnerability"
aliases: ["CVE-2026-91358"]
title: "Oracle BPM Suite: unauthenticated HTTP flaw exposes critical data in Case Management"
severity: "high"
cvss: 8.2
epss: 0.00339
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "oracle-bpm", "oracle-fusion-middleware", "package"]
not_affected_if: ["bpm-not-deployed"]
published_at: "2026-10-20T22:20:38+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91358", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91358", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle BPM Suite: unauthenticated HTTP flaw exposes critical data in Case Management

Oracle Business Process Management Suite's Case Management Service, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over HTTP without logging in. An attacker can read critical data and modify or delete some of the data the suite can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle BPM Suite version against `12.2.1.4.0` and `14.1.2.0.0`
- Confirm whether the Case Management Service is deployed and reachable over HTTP

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Business Process Management Suite (the sources do not name the patched version)
- Restrict network access to the Case Management Service until patched

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91358
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91358

## From the sources

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_