Oracle Business Process Management Suite: Authentication bypass in BPM Composer
Summary
A vulnerability in the BPM Composer component of Oracle Business Process Management Suite, part of Oracle Fusion Middleware, affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with low privileges and network access via HTTP can exploit it with low complexity and no user interaction. Successful exploitation can lead to a complete takeover of the affected Oracle Business Process Management Suite, with high impact on confidentiality, integrity and availability.
Affected
- Oracle Business Process Management Suite 12.2.1.4.0
- Oracle Business Process Management Suite 14.1.2.0.0
- Component: BPM Composer
Fixed in
Unknown. Fixed patch level and patch number have not been verified. Obtain them from Oracle's October 2026 Critical Patch Update advisory or from My Oracle Support.
Workaround
Unknown. Oracle has not published a workaround in the CVE record. Generic hardening until patching: restrict HTTP access to BPM Composer to administrative networks or VPN, and tighten role-based access.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in the CISA KEV catalog as of 21 October 2026.
- No public proof of concept found.
- EPSS score 0.00447.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether BPM Suite 12.2.1.4.0 or 14.1.2.0.0 is in use and whether BPM Composer is installed.
- Remove any internet exposure of BPM Composer now and restrict access to admin networks or VPN.
- Review BPM user accounts and roles, and remove unneeded accounts.
- Obtain the exact patch identifier and fixed version from Oracle's October 2026 advisory, test in a non-production environment, then apply.
- Check all other BPM entries in the October 2026 CPU, some of which are rated higher.
- Re-check NVD and CISA KEV, as the record is new and the CWE is still under review.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- Oracle Blog: October 2026 Critical Patch Update released blogs.oracle.com
- NVD mirror via Vulners: CVE-2026-91213 vulners.com
- Brandefense: Oracle October 2026 CPU brandefense.io
- Strix: CVE-2026-91213 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:36.
Original description (NVD)
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.