Key points
- CVE-2026-91243 affects Oracle Fusion Middleware Fabric Layer components.
- The flaw carries a CVSS score of 9.6, rated Critical.
- Attackers can create, delete, or modify critical data with network access.
Oracle Business Process Management Suite contains a critical vulnerability that allows attackers to manipulate data through HTTP requests. This flaw, identified as CVE-2026-91243, affects specific versions of the Oracle Fusion Middleware Fabric Layer. Developers using these components must verify their installation status immediately, as the vulnerability is easily exploitable by low-privileged users who have network access to the server.
The affected versions are 12.2.1.4.0 and 14.1.2.0.0. According to the National Vulnerability Database, the issue allows unauthorized creation, deletion, or modification of critical data. The vulnerability also permits complete access to all data accessible via the Business Process Management Suite. Because the flaw exists in the Fabric Layer, successful attacks may significantly impact additional products beyond the initial scope, expanding the potential damage surface for compromised environments.
What we know
The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.6 to this issue, classifying it as Critical. The vector string indicates network accessibility, low complexity, and low privilege requirements. No user interaction is needed for exploitation. The impact includes high confidentiality and integrity losses, with no availability impact recorded. The scope of the vulnerability changes, meaning attacks can affect resources beyond the vulnerable component itself.
Defender's checklist
- Audit all Oracle Business Process Management Suite installations for versions 12.2.1.4.0 and 14.1.2.0.0.
- Review HTTP traffic logs for unauthorized data creation or modification attempts.
- Restrict network access to the Fabric Layer components to trusted internal subnets.
- Monitor for unusual privilege escalation attempts by low-privileged accounts.
What analysts watch for
Teams usually examine HTTP request patterns for anomalous data manipulation verbs such as PUT or DELETE. Analysts check whether low-privileged accounts are accessing sensitive endpoints without proper authorization. They look for signs of scope change, where activity spills over into adjacent middleware components. Persistence mechanisms often involve modifying configuration files or injecting malicious business process definitions. Investigators review access logs for sudden volume spikes in data retrieval or modification actions that deviate from normal operational baselines.
What to do and how to stay safe: Oracle
- Verify if your environment runs Oracle BPM Suite versions 12.2.1.4.0 or 14.1.2.0.0.
- Implement strict network segmentation to limit HTTP access to the Fabric Layer.
- Enable detailed logging on all HTTP endpoints to detect unauthorized data changes.
- Once the vendor provides an update, apply it immediately to mitigate the risk.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Oracle products are affected by CVE-2026-91243?
Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0 within Oracle Fusion Middleware are affected.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates it Critical with a CVSS 3.1 Base Score of 9.6.
Can an attacker exploit this without user interaction?
Yes, the vulnerability allows exploitation via HTTP with network access and no user interaction required.
