What is the CVSS score of CVE-2026-60542?

CVE-2026-60542 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Business Process Management Suite are affected by CVE-2026-60542?

Oracle Business Process Management Suite in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be completely compromised by attackers with low-level access to network protocols, potentially…

How to fix or mitigate CVE-2026-60542?

Within 24 hours, inventory all systems running Oracle Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0 and identify business-critical processes dependent on BPM; implement immediate firewall restrictions to limit access to T3 and IIOP protocol endpoints from administrative networks only. Within 7 days, contact Oracle support for interim remediation guidance, deploy enhanced monitoring and logging on affected BPM systems to detect suspicious protocol access, and conduct a formal risk assessment of each affected deployment. Within 30 days, evaluate and plan implementation of available workarounds or upgrades to Fusion Middleware versions after 14.1.2.0.0, and establish persistent network access controls as long-term compensating measures pending patch release.

Business Process Management Suite CVE-2026-60542

EUVD-2026-46904 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6rwx-grjq-q99f

Oracle Authentication Bypass Business Process Management Suite

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:45 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Business Process Management Suite is possible when a low-privileged attacker reaches the T3 or IIOP protocol endpoints of the Human Workflow component in Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0. Because the flaw carries a scope change, successful exploitation impacts additional products beyond BPM itself, yielding compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the 9.9 CVSS and low attack complexity make this a top-priority patch from Oracle's July 2026 Critical Patch Update.