Oracle Business Process Management Suite: Missing authentication in Case Management
Summary
Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0 have a flaw in the Case Management Service that lacks authentication (CWE-306, as reported in the input data). A remote attacker with network access via HTTP and no login can gain access to critical data and to all data accessible in the suite, and can also change, insert or delete some of that data. The CVSS 3.1 base score is 8.2 (high). Only organisations that run these BPM versions are affected.
Affected
- Oracle Business Process Management Suite 12.2.1.4.0
- Oracle Business Process Management Suite 14.1.2.0.0
Fixed in
Unknown. The patch for BPM Case Management is listed in the Fusion Middleware section of Oracle's October 2026 Critical Patch Update advisory. Use the current revision on the Oracle page.
Workaround
Unknown. No BPM-specific workaround from Oracle was found.
- Until patched, restrict HTTP access to the Case Management endpoints to internal networks or VPN only (own recommendation, not from Oracle).
- Place the endpoints behind a reverse proxy or WAF with logging.
Exploitation
- No public proof of concept was found.
- No listing in the CISA KEV catalogue was found in the research; this should be rechecked.
- Oracle and SecurityWeek have not flagged the October 2026 CPU as exploited in the wild.
Our recommendation
- Check whether BPM 12.2.1.4.0 or 14.1.2.0.0 is installed, including through a vendor or integrator.
- If it is installed, apply the Oracle October 2026 CPU patch for BPM as a priority.
- Until then, restrict access to the endpoints and review HTTP access logs for unexpected unauthenticated requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- Oracle Security Alerts www.oracle.com
- Vulners CVE-2026-91358 vulners.com
- Strix CVE-2026-91358 www.strix.ai
- SecurityWeek: Oracle patches over 1200 vulnerabilities with October 2026 CPU www.securityweek.com
- Brandefense: Oracle October 2026 Critical Patch Update brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:25.
Original description (NVD)
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management Service (11g+)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.