CVE-2026-91220 is a critical (CVSS 9.8) vulnerability in the Human Workflow component of Oracle Business Process Management Suite that lets an unauthenticated attacker with network access take over the product over HTTP.
What Is It
CVE-2026-91220 is a vulnerability in Oracle Business Process Management Suite, part of Oracle Fusion Middleware. It sits in the Human Workflow component. Oracle describes it as "easily exploitable": an attacker with network access over HTTP can compromise the product, and a successful attack can lead to full takeover of Oracle Business Process Management Suite.
NVD published the record on October 20, 2026. Its status is "Received," which means NVD has not yet done its own analysis. Oracle did not disclose the type of weakness or a CWE classification.
Why It Matters
Oracle scored the flaw 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack Vector: Network. It can be exploited remotely over HTTP.
- Attack Complexity: Low. No special conditions are needed.
- Privileges Required: None. No authentication is needed.
- User Interaction: None. No victim has to take any action.
- Impact: High on confidentiality, integrity, and availability.
The exploitability subscore is 3.9 and the impact subscore is 5.9. A remotely reachable, unauthenticated flaw that leads to full product takeover deserves urgent attention, especially on internet-facing BPM Suite deployments.
As of this writing, CVE-2026-91220 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Business Process Management Suite (Oracle Fusion Middleware)
- Component: Human Workflow
- Affected supported versions:
- 12.2.1.4.0
- 14.1.2.0.0
NVD has not yet published CPE configuration data for this record.
Patch Status
The vendor reference for this CVE is Oracle's October 2026 Critical Patch Update (CPU) advisory. Administrators running affected versions should check that advisory for the fixes and apply them. Because no KEV entry exists, CISA has not set a required action or a federal remediation due date. Given the CVSS 9.8 score and the unauthenticated network attack vector, organizations should treat patching as a high priority. Until patches are applied, they should limit network exposure of the Human Workflow component.