CVE-2026-91243
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Fabric Layer component of Oracle Business Process Management Suite, a critical part of the Oracle Fusion Middleware ecosystem affecting versions 12.2.1.4.0 and 14.1.2.0. This security flaw is characterized by its high severity, with a CVSS 3.1 Base Score of 9.6, indicating a Critical level risk that demands immediate attention from system administrators and security operations teams. The vulnerability stems from an architectural weakness in the Fabric Layer that permits low-privileged attackers to execute unauthorized actions against the application infrastructure. Unlike vulnerabilities requiring high-level administrative privileges or complex user interaction, this flaw can be exploited by any authenticated user with basic network access via HTTP, significantly lowering the barrier for entry and increasing the likelihood of successful exploitation in environments where internal users may have varying levels of trust.
The technical nature of this vulnerability allows an attacker to compromise the integrity and confidentiality of data managed by Oracle Business Process Management Suite. Specifically, the flaw enables unauthorized creation, deletion, or modification of critical data within the system. This capability extends beyond simple data manipulation; it can lead to a complete scope change where attacks targeting the Business Process Management Suite significantly impact additional products integrated with or dependent on this middleware layer. The operational impact is severe, as successful exploitation grants attackers either unauthorized access to sensitive information or full control over accessible data assets. This dual impact on both confidentiality and integrity means that an attacker can not only exfiltrate proprietary business process definitions, workflow configurations, and user credentials but also alter these elements to disrupt operations or inject malicious logic into automated workflows.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it allows low-privileged users to perform actions that should be restricted to higher-level administrators. Furthermore, the ability to modify and delete critical data maps directly to CWE-732 Incorrect Permission Assignment for Critical Resource, while the potential for unauthorized access correlates with CWE-862 Missing Authorization. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques associated with Initial Access via valid accounts and subsequent actions like Data Manipulation or Defense Evasion through modification of system configurations. The network-based nature of the exploit means it can be leveraged remotely without requiring physical access to the target systems, making it particularly dangerous in cloud-hosted or externally facing deployments where HTTP traffic is routinely permitted.
The scope change mentioned in the advisory highlights a critical risk factor known as side-channel impact or cascading failure within middleware architectures. Because Oracle Fusion Middleware components are often tightly coupled, compromising one component like Business Process Management can provide an attacker with a foothold to pivot into other connected services such as Identity Management, SOA Suite, or custom enterprise applications. This lateral movement potential amplifies the overall risk profile of the organization's IT infrastructure. The high confidentiality and integrity impacts noted in the CVSS vector underscore that data loss is not merely theoretical but highly probable if the vulnerability remains unpatched. Attackers can leverage this access to steal intellectual property, manipulate financial records embedded in business processes, or disrupt critical operational workflows by deleting essential configuration files or process definitions.
Mitigation strategies must prioritize immediate patching of Oracle Business Process Management Suite to version 12.2.1.4.0 and later patches for 14.1.2.0.0 that address this specific Fabric Layer flaw. In addition to applying vendor-supplied updates, organizations should implement strict network segmentation policies to limit HTTP access to the middleware layer from untrusted networks. Implementing Web Application Firewalls with rules specifically tuned to detect anomalous data manipulation patterns can provide an additional layer of defense against exploitation attempts. Access control lists and role-based access controls should be reviewed to ensure that low-privileged users do not possess unnecessary permissions within the Business Process Management environment, adhering to the principle of least privilege. Regular vulnerability scanning and penetration testing focused on middleware components are essential to identify similar misconfigurations or unpatched flaws before they can be leveraged by malicious actors for significant organizational harm.