The vulnerability in Oracle Business Process Management Suite permits an unauthenticated attacker who can reach the system via HTTP to execute code with full application privileges. An attacker can compromise confidentiality, integrity, and availability of the system, effectively taking over the entire Oracle Business Process Management Suite. The weakness results in a complete takeover of the application, with no need for prior authentication.

Oracle Corporation’s Oracle Business Process Management Suite for Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0, are affected. These versions host the Human Workflow component that is vulnerable.

The CVSS 3.1 score of 9.8 indicates high severity, with network-based attacks (AV:N) that require low effort (AC:L) and no user interaction (UI:N). The EPSS score of 0.00486 indicates a very low but nonzero probability of exploitation, and the lack of a KEV listing does not mitigate the risk, given the remote nature of the flaw. Based on the description, the attack vector is inferred to be HTTP traffic targeting the Human Workflow service; an attacker does not need credentials or elevated privileges to launch the exploit.