A vulnerability in Oracle Business Process Management Suite, specifically the BPM Composer component of Oracle Fusion Middleware, allows a low‑privileged attacker who can reach the application over HTTP to compromise the system. The flaw enables an attacker to gain full control of the BPM Composer installation, potentially allowing execution of arbitrary code, based on the description the attacker may be able to manipulate and tamper with business processes. The weakness is an authentication bypass (CWE‑287), and results in high confidentiality, integrity, and availability impact, as reflected in a CVSS 3.1 base score of 8.8.

The affected product is Oracle Business Process Management Suite from Oracle Corporation, part of Oracle Fusion Middleware, with vulnerable releases 12.2.1.4.0 and 14.1.2.0.0. These versions are used in enterprise workflows and are deployed in environments where BPM Composer orchestrates business process automations.

The vulnerability is readily exploitable over the public or internal network using the default HTTP interface, with low privileged credentials. While an EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation, the high CVSS score and absence of a KEV listing do not reduce the risk. The attacker may use this flaw to potentially execute arbitrary commands, gain system‑wide authority, or disrupt business operations, based on the description.