A critical (CVSS 9.9) vulnerability in the Human Workflow component of Oracle Business Process Management Suite lets a low-privileged attacker with network access take over the product over SOAP.
What Is It
CVE-2026-91222 is a vulnerability in Oracle Business Process Management Suite, part of Oracle Fusion Middleware. It sits in the Human Workflow (11g+) component. Oracle describes it as "easily exploitable." An attacker with low privileges and network access over SOAP can use it to compromise the product.
NVD published the record on 2026-10-20 with a status of "Received." The source is Oracle ([email protected]).
Why It Matters
Oracle scores this flaw 9.9 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Network attack vector with low attack complexity
- Low privileges required and no user interaction
- Changed scope: attacks may significantly affect products beyond Oracle Business Process Management Suite
- High impact to confidentiality, integrity, and availability
Oracle says a successful attack can result in takeover of Oracle Business Process Management Suite. An attacker needs only a low-privileged account. No user interaction is required, and the scope change can affect other products. That makes this a high-priority fix for any organization with these deployments reachable over the network.
Exploitation status: CVE-2026-91222 is not currently in CISA's Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm any active exploitation.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Business Process Management Suite (Oracle Fusion Middleware)
- Component: Human Workflow (11g+)
- Affected supported versions:
- 12.2.1.4.0
- 14.1.2.0.0
NVD has not yet listed any affected CPEs for this record.
Patch Status
Oracle's reference for this CVE is its October 2026 Critical Patch Update advisory. Administrators running the affected versions should check that advisory for the fix and apply it.
Since the CVE is not in KEV, CISA has issued no required action or due date. Given the critical score and low barrier to attack, defenders should still prioritize patching. Until the patch is in place, they should check which Human Workflow SOAP endpoints are exposed to the network.
Sources
- NVD, CVE-2026-91222
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91222 not listed)