CVE-2026-91243 is a critical (CVSS 9.6) flaw in the Fabric Layer component of Oracle Business Process Management Suite: a low-privileged attacker can exploit it over HTTP to read and change critical data, and the impact can reach other products.
What Is It
CVE-2026-91243 is in the Fabric Layer component of Oracle Business Process Management Suite, which is part of Oracle Fusion Middleware. Oracle describes it as "easily exploitable." An attacker needs network access over HTTP and only low-level privileges. No user interaction is required.
Oracle reported the flaw (source: [email protected]). NVD published it on 2026-10-20 and lists its status as "Received," so NVD has not yet completed its own analysis.
Why It Matters
The CVSS 3.1 base score is 9.6 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. In practice:
- Network-reachable, low complexity: an attacker can reach it remotely, and exploitation needs no special conditions.
- Low privileges, no user interaction: any authenticated low-privilege account could be enough.
- Scope change: the flaw is in BPM Suite, but Oracle says attacks "may significantly impact additional products."
- High confidentiality and integrity impact: a successful attack can let someone create, delete or change critical data or all data BPM Suite can reach. It can also give unauthorized or complete read access to that data. Availability is not affected.
There is no CISA KEV entry for this CVE in the source data. Active exploitation is not confirmed at this time.
What's Vulnerable
Oracle lists these supported versions of Oracle Business Process Management Suite as affected:
- 12.2.1.4.0
- 14.1.2.0.0
The NVD record does not list any CPE entries yet.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update (CPU) advisory. Administrators running the affected BPM Suite versions should check that advisory for fixes and apply the updates it lists. Because the attack requires only low privileges and works over the network, prioritize exposed or widely accessible Fusion Middleware deployments.
CISA has not issued a required action for this CVE, because it is not in the KEV catalog.