EUVD-2026-106498
GHSA-6hv5-x898-h56c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged BPM account access
-
ExploitSend crafted HTTP request to Fabric Layer
-
ExecutionExploit scope-change flaw across products
-
ImpactRead and modify critical data in affected products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged account on Oracle Business Process Management Suite (CVSS PR:L) with network HTTP access to the Fabric Layer component; it is not remote-unauthenticated. Affected deployments are specifically versions 12.2.1.4.0 and 14.1.2.0.0. No user interaction is needed (UI:N) and complexity is low (AC:L), but the scope change (S:C) means successful attacks can propagate impact to additional Oracle products beyond BPM Suite. The principal limiting factor is the need for authenticated low-privileged access rather than any special non-default configuration. |
| Impact | This is a genuinely high-priority flaw on paper, but several key exploitation signals are missing. The CVSS 3.1 base score of 9.6 is driven by a network attack vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), a scope change (S:C), and high confidentiality and integrity impact (C:H/I:H) - the score is elevated primarily by the scope change, which indicates compromise can extend beyond Oracle BPM Suite into additional products. Critically, the attacker is NOT unauthenticated: the vector specifies PR:L, so a low-privileged but valid account is required, which meaningfully narrows the exploitation population versus a pure pre-auth bug. No EPSS probability was supplied, there is no CISA KEV listing, and no public POC was identified, so there is no public exploit identified at time of analysis - exploitation is theoretically easy ('easily exploitable' per Oracle) but not yet demonstrated to be occurring. Note a data conflict: the input Tags include 'Authentication Bypass,' yet the CVSS vector requires PR:L (an authenticated low-privileged attacker), which is inconsistent with a true authentication bypass - this tag should be verified against the Oracle advisory. Net assessment: patch promptly given the scope-change and high C/I impact in enterprise middleware, but the PR:L requirement and absence of KEV/EPSS/POC suggest this is not yet under active mass exploitation. |
| Exploit ScenarioDerived | A low-privileged user with a valid Oracle BPM Suite account (or an attacker who has phished/obtained such credentials) sends a crafted HTTP request to the vulnerable Fabric Layer component over the network. Because low attack complexity and no user interaction are required, the attacker reads and modifies critical BPM data, and due to the scope change the impact extends into additional Oracle Fusion Middleware products. No public exploit code has been identified, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated low-privileged attackers with network access to the Fabric Layer component of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can achieve high confidentiality and integrity impact, including creation, deletion, or modification of critical data and full read access to BPM Suite data, with scope change extending impact to additional Oracle products. The flaw requires a valid account (CVSS PR:L) but no user interaction and low attack complexity, making it easily exploitable once credentials are obtained. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which contains the vendor fixes for Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0; this is the primary remediation and should be prioritized given the high CVSS score. Until patching is complete, restrict network access to the Fabric Layer HTTP endpoints to trusted administrative networks, enforce least-privilege accounts and strong authentication for BPM Suite users, and monitor for anomalous creation, deletion, or modification of critical data-trade-offs include reduced operational flexibility and potential disruption to legitimate integrations. Because exploitation requires only low-privileged credentials, audit existing accounts for excessive privileges and rotate credentials if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Business Process Management Suite is part of Oracle Fusion Middleware, and the vulnerability resides in its Fabric Layer component, which handles HTTP-based process orchestration and integration. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates a network-reachable flaw that requires a low-privileged authenticated session, needs no user interaction, and has low attack complexity; the scope change (S:C) means a compromise can affect resources beyond the BPM Suite security authority, potentially impacting other Oracle products in the deployment. No CWE is assigned in the available data, but the impact class is unauthorized data modification and access, consistent with an access-control or authorization weakness in the Fabric Layer. EUVD confirms the affected versions as 12.2.1.4.0 and 14.1.2.0.0; no CPE strings were provided.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network HTTP vector (AV:N), low complexity (AC:L), authenticated low-privileged attacker (PR:L), no interaction (UI:N), scope change to other products (S:C), high C/I but no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Executive ViewAI
Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical scope-changing flaw in the Fabric Layer component that allows any low-privileged authenticated user with network reach to read, create, alter, or delete critical BPM data, with impact extending into other Oracle products. Leadership should care because the barrier to abuse is a single valid account - including contractor, service, or orphaned credentials - and successful abuse can corrupt business process integrity and expose sensitive workflow data across interconnected systems. With no vendor patch currently available, exposure must be managed through access controls and monitoring rather than remediation.
No vendor patch available; restrict Fabric Layer network access to trusted sources, enforce least privilege and MFA on all accounts, rotate credentials, remove stale or shared accounts, and monitor for anomalous data modification or bulk reads. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB