CVE-2026-91220

Summary

This vulnerability allows unauthenticated attackers to fully compromise the Oracle Business Process Management Suite through HTTP requests, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw enables attackers to take complete control of the affected system with high impact on confidentiality, integrity, and availability.

Exploitability

The vulnerability is easily exploitable with no authentication required, allowing attackers to compromise the system through simple HTTP network access with minimal preconditions.

Blast radius

If exploited, this vulnerability could lead to complete takeover of business process management workflows, potentially affecting critical business operations and data integrity across enterprise processes.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Oracle Business Process Management Suite version 14.1.3.0.0 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.