{"id":"CVE-2026-91220","published":"2026-10-20T22:20:22.470","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated attackers to fully compromise the Oracle Business Process Management Suite through HTTP requests, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw enables attackers to take complete control of the affected system with high impact on confidentiality, integrity, and availability.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers to compromise the system through simple HTTP network access with minimal preconditions.","blast_radius":"If exploited, this vulnerability could lead to complete takeover of business process management workflows, potentially affecting critical business operations and data integrity across enterprise processes.","remediation":"Upgrade to Oracle Business Process Management Suite version 14.1.3.0.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","rce","business-process"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:24:48.206Z"}}