Oracle Business Process Management Suite: Authentication bypass in Human Workflow
Summary
Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Human Workflow component that allows unauthenticated access. An attacker with network access via HTTP can exploit it with low complexity and no user interaction. Successful exploitation can lead to takeover of the BPM Suite, with high impact on confidentiality, integrity and availability (CVSS 9.8, Critical).
Affected
- Oracle Business Process Management Suite 12.2.1.4.0
- Oracle Business Process Management Suite 14.1.2.0.0
- Component: Human Workflow (CWE-287, CWE-306)
Fixed in
- Fixed in the Oracle Critical Patch Update of October 2026 (released 20 October 2026).
- Specific patch number and fixed version for each affected release: Unknown. Check the Oracle advisory patch table.
Workaround
- Unknown. Oracle has published no workaround in the CVE record.
- Interim measure (own recommendation, not from a vendor source): restrict HTTP access to BPM endpoints to trusted networks until patched.
Exploitation
- Oracle reports no known exploitation.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in the CISA KEV catalog as of 21 October 2026.
- EPSS approximately 0.0045 (low).
- Public proof of concept: none found.
Our recommendation
- Check whether BPM Suite 12.2.1.4.0 or 14.1.2.0.0 is deployed and whether its HTTP endpoints are reachable from the internet.
- Apply the October 2026 Oracle CPU, including Fusion Middleware dependencies, and patch related CVE-2026-91222 and CVE-2026-91213 together.
- Until patched, restrict access to BPM endpoints to trusted networks and review logs for unexpected HTTP requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- OpenCVE - CVE-2026-91220 app.opencve.io
- Vulners - NVD:CVE-2026-91220 vulners.com
- Strix - CVE-2026-91220 www.strix.ai
- SecurityWeek - Oracle patches over 1200 vulnerabilities with October 2026 CPU www.securityweek.com
- Brandefense - Oracle October 2026 Critical Patch Update brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:14.
Original description (NVD)
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.