Oracle BPM Suite CVE-2026-91222

Exploitation requires network access to the Oracle Business Process Management Suite's Human Workflow (11g+) component via SOAP, plus a low-privileged authenticated account (CVSS PR:L) - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker holds any valid low-privilege credential, exploitation against the affected versions (12.2.1.4.0 and 14.1.2.0.0) is straightforward. The primary limiting factor is the authentication requirement; the scope change (S:C) means successful attacks may extend impact to additional products beyond BPM Suite itself.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) is internally consistent with the description: network-reachable via SOAP, low attack complexity, only low privileges required, no user interaction, a scope change, and full confidentiality/integrity/availability loss culminating in product takeover. The combination of low complexity and only low-privilege requirement makes this attractive and reliable once an attacker has any authenticated foothold. However, several corroborating risk signals are absent from the input: no EPSS exploitation-probability score is provided, CISA KEV status is not present (no confirmed active exploitation), and no public proof-of-concept is referenced. The only source is the Oracle Critical Patch Update advisory (cpuoct2026.html), which is authoritative for the existence and fix but does not indicate in-the-wild use. Net: treat as urgent to patch for any Oracle Fusion Middleware / BPM Suite operator because of the very high technical impact and low exploitation barrier, while recognizing that real-world exploitation prevalence is currently unproven and the low-privilege prerequisite narrows the attacker population to those who already possess some valid credential or account.

A low-privileged user holding any valid account on the Oracle BPM Suite sends a crafted SOAP request to the Human Workflow component over the network. Because the flaw carries a scope change with full CIA impact, the request lets the attacker escalate to complete takeover of the BPM Suite and potentially impact additional connected products. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector rather than a demonstrated PoC.