Oracle BPM Suite SOAP Vulnerability CVSS 9.9 Enables Remote Takeover in Versions 12.2 and 14.1

An attacker with network access and low privileges can fully compromise Oracle Business Process Management Suite by exploiting a flaw in its SOAP interface. This vulnerability, tracked as CVE-2026-91222, grants the intruder complete control over the application. The National Vulnerability Database rates the issue as critical with a CVSS score of 9.9. Successful exploitation results in total takeover of the system, affecting confidentiality, integrity, and availability. The scope of the attack may extend beyond the initial component to impact additional products within the Oracle Fusion Middleware ecosystem.

How it unfolded

• Oracle Business Process Management Suite contains a vulnerability in the Human Workflow component.
• The flaw is present in supported versions 12.2.1.4.0 and 14.1.2.0.0.
• Attackers can exploit the weakness remotely via SOAP with low privileges and no user interaction.

Who is affected

Organizations running Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0 are directly exposed to this risk. The vulnerability resides in the Human Workflow component of the product. According to the NVD record, the flaw is easily exploitable by anyone with network access to the service. Because the attack vector is remote, external adversaries do not need physical proximity or high-level credentials to initiate the compromise. The potential for scope change means that damage may spread to other connected products within the middleware environment.

The fix

No patch or update has been confirmed yet for this vulnerability. Administrators should monitor official channels from Oracle for security advisories regarding CVE-2026-91222. Until a vendor-provided fix is available, systems running the affected versions remain at risk of remote takeover. Users should verify their current version against the affected list to determine exposure.

What made it possible

This incident highlights the risks of exposing management interfaces to untrusted networks. Teams usually restrict SOAP endpoints to internal segments to prevent unauthorized access. Check whether your architecture allows direct external connections to workflow components. Limiting network reachability reduces the attack surface for remote exploitation. Ensure that authentication mechanisms are robust and that low-privileged accounts have minimal permissions. Monitoring for unusual SOAP traffic patterns can help detect early signs of intrusion attempts before full system compromise occurs.

What to do and how to stay safe: Oracle

• Verify if your environment runs Oracle BPM Suite versions 12.2.1.4.0 or 14.1.2.0.0.
• Restrict network access to SOAP endpoints to trusted internal IPs only.
• Monitor logs for unauthorized SOAP requests from low-privileged accounts.
• Await official vendor patches before applying unverified workarounds.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Oracle BPM Suite are affected by CVE-2026-91222?

Versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Business Process Management Suite are affected.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.9.

Does this flaw require user interaction to exploit?

No, the vulnerability can be exploited without user interaction via SOAP.