{"id":"CVE-2026-91222","published":"2026-10-20T22:20:22.697","lastModified":"2026-10-21T18:44:40.020","description":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows low-privileged attackers with network access to take over the Oracle Business Process Management Suite through SOAP requests, potentially affecting multiple Oracle products due to scope change.","exploitability":"The vulnerability is easily exploitable with low privileges and requires only network access via SOAP, making it straightforward for attackers to compromise the system.","blast_radius":"Successful exploitation could lead to complete takeover of the Oracle Business Process Management Suite and potentially impact other Oracle Fusion Middleware products due to the scope change.","remediation":"Upgrade to Oracle Business Process Management Suite 14.1.2.0.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["soa","bpm","oracle","web-service"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:20:30.648Z"}}