Business Process Management Suite CVE-2026-60542

Oracle Business Process Management Suite in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be completely compromised by attackers with low-level access to network protocols, potentially affecting all interconnected enterprise systems. Although no public exploit identified at time of analysis, the critical severity (CVSS 9.9) and low attack complexity make this a high-priority threat that could enable attackers to access, modify, or disrupt mission-critical business processes. Immediate mitigation is required pending vendor patch availability.

Within 24 hours, inventory all systems running Oracle Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0 and identify business-critical processes dependent on BPM; implement immediate firewall restrictions to limit access to T3 and IIOP protocol endpoints from administrative networks only. Within 7 days, contact Oracle support for interim remediation guidance, deploy enhanced monitoring and logging on affected BPM systems to detect suspicious protocol access, and conduct a formal risk assessment of each affected deployment. Within 30 days, evaluate and plan implementation of available workarounds or upgrades to Fusion Middleware versions after 14.1.2.0.0, and establish persistent network access controls as long-term compensating measures pending patch release.

Implement network access controls to restrict T3 and IIOP protocol endpoints to authorized administrative networks only; deploy protocol-level monitoring and alerting for detection of exploitation attempts; enable comprehensive logging on all BPM systems; apply principle of least privilege to user accounts with BPM access; isolate affected systems on dedicated network segments where operationally feasible; engage Oracle support for interim hardening configurations or patches if available.