EUVD-2026-24366Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable via HTTP with no auth (AV:N/PR:N), user interaction required to trigger (UI:R), limited C/I impact with scope change to adjacent Fusion Middleware components (S:C/C:L/I:L/A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data as well as unauthorized read access to a subset of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
AnalysisAI
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.
Technical ContextAI
The affected component is the Human Workflow subsystem of Oracle Business Process Management Suite, a Java EE-based enterprise middleware platform within Oracle Fusion Middleware. The CPE string (cpe:2.3:a:oracle_corporation:oracle_business_process_management_suite) covers both the 12.2.1.4.0 and 14.1.2.0.0 release lines. CWE-284 (Improper Access Control) is the root cause class, indicating that the Human Workflow component fails to enforce appropriate authorization boundaries for certain HTTP-reachable operations or endpoints. Combined with the CVSS 'Scope: Changed' metric and the 'Authentication Bypass' tag, the flaw likely allows an unauthenticated external party to reach data or actions that should require authenticated, role-limited access within the BPM workflow engine - and the resulting impact can propagate to adjacent Fusion Middleware components sharing session or data context.
RemediationAI
Apply the patches provided in Oracle's April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle does not disclose patched version strings independently of the CPU matrix; consult that advisory to identify the precise patched build for your 12.2.1.4.0 or 14.1.2.0.0 installation. Where immediate patching is not feasible, compensating controls should focus on reducing exposure of the Human Workflow HTTP endpoints: restrict network access to the BPM Suite's HTTP listener to trusted internal networks or authenticated reverse-proxy paths, enforce per-origin CORS policy on the application layer, and require authenticated sessions before routing to Human Workflow endpoints if the application architecture permits it. Note that restricting network access reduces exploitation risk directly but does not eliminate it if the attacker has access from a trusted network segment.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today