EUVD-2026-106612
GHSA-g5mx-vf68-wj3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach BPM HTTP endpoint over network
-
DeliverySend crafted request to Case management Service
-
ExploitTrigger unauthenticated access flaw
-
ExecutionRead all accessible BPM data
-
ImpactInsert/update/delete some data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle BPM Suite HTTP interface specifically targeting the Case management Service component (11g+), on affected versions 12.2.1.4.0 or 14.1.2.0.0. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no special privileges, and no user interaction are required against a reachable instance, so the main limiting factor is network exposure - instances restricted to internal/segmented networks or fronted by access controls are substantially harder to reach. No non-default configuration prerequisite is stated by Oracle; the only named precondition is that the Case management Service feature of BPM Suite be deployed and network-accessible. |
| Impact | Oracle rates this 8.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction - the profile of a readily exploitable issue. The primary impact is confidentiality (C:H: 'complete access to all accessible data') with partial integrity impact (I:L: 'update, insert or delete some data') and no availability impact (A:N). Mitigating the raw severity: no EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is indicated - so there is currently no evidence of active or imminent widespread exploitation, and this should be treated as a patch-on-cycle priority rather than an emergency. One data conflict to verify: the CVSS vector says PR:N (unauthenticated), which is consistent with the description's 'unauthenticated attacker,' but the input Tags label this 'Authentication Bypass' - the description describes direct unauthenticated access, not a bypass of an auth mechanism, so the tag may be loosely applied; confirm exploit mechanics against Oracle CPU October 2026 detail. For internet-exposed BPM instances this is a real priority; for internal-only deployments the lack of KEV/POC/EPSS signal lowers urgency. |
| Exploit ScenarioDerived | An attacker with network access sends crafted HTTP requests to the Case management Service component of an exposed Oracle BPM Suite instance, requiring no credentials or user interaction given AV:N/AC:L/PR:N/UI:N. This yields read access to all BPM-accessible data and the ability to insert, update, or delete some data. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle BPM Suite 12.2.1.4.0 and 14.1.2.0.0 expose the Case Management Service (11g+) to unauthenticated, low-complexity HTTP attacks that can read critical data and make limited unauthorized changes. Oracle rates the issue 8.2 (High) with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, meaning no credentials or user interaction are required against a reachable instance. No public exploit was identified at time of analysis, so exposure is primarily a function of whether the BPM Suite HTTP interface is reachable from untrusted networks.
RemediationAI
Apply the Oracle Critical Patch Update fixes referenced in the October 2026 advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; the advisory is the authoritative source for the exact patched version, which is not specified in the provided data. Until patching is complete, restrict network access to the BPM Suite HTTP interface - especially the Case Management Service - to trusted networks or approved users via firewall rules, reverse-proxy access controls, or a WAF, recognizing that this reduces but does not eliminate exposure for allowed clients. If Case Management Service is not required, undeploy or disable it and confirm the HTTP endpoint is no longer reachable; this removes the attack surface but may break dependent case-management workflows. Monitor BPM Suite and Case Management Service logs for anomalous unauthenticated requests.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Business Process Management Suite is part of Oracle Fusion Middleware and provides case management workflows through the Case Management Service component (11g+). The provided data does not specify a CWE, so the exact root-cause class is unconfirmed; however, the 'Authentication Bypass' tag and the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicate that a network attacker can reach Case Management Service functionality without valid credentials and without user interaction. Successful exploitation affects confidentiality heavily (C:H) and integrity partially (I:L), while availability is not impacted (A:N). No CPE strings were supplied, so affected deployment identification relies on the stated BPM Suite versions 12.2.1.4.0 and 14.1.2.0.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description confirms unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N), full data read (C:H), partial write to some data (I:L), and no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management Service (11g+)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Executive ViewAI
Oracle BPM Suite versions 12.2.1.4.0 and 14.1.2.0.0 expose the Case Management Service to unauthenticated network attacks that can read sensitive business data and make limited unauthorized changes. Because no credentials or user interaction are required, any reachable instance effectively lowers the barrier for an outside party to access case and process data that leadership is accountable for protecting. The exposure is driven less by threat activity than by network architecture: if the BPM HTTP interface is internet-facing or reachable from untrusted segments, the organization's risk is immediate and increases with every day a vendor fix remains unavailable.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or firewall untrusted network access to the BPM Suite HTTP interface; require VPN or an authenticating reverse proxy for Case Management Service access; deploy WAF rules to filter anomalous requests to the affected endpoints; enforce least privilege on BPM application and database accounts; and monitor HTTP logs for unusual access to case and process data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB