The vulnerability resides in the Human Workflow component (11g+) of Oracle Business Process Management Suite and permits an attacker with low-level privileges and network access via SOAP for exploitation. Successful exploitation can lead to a full takeover of the BPM environment, compromising confidentiality, integrity, and availability of data across the suite, and due to the scope change may impact other Fusion Middleware products.

Affected versions include Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0. These releases are supported as of the current middleware version list and remain vulnerable until patched.

The CVSS 3.1 base score of 9.9 indicates critical severity, with confidentiality, integrity, and availability impacts. The EPSS score of <1% reflects a very low likelihood of exploitation in the wild, yet the attack requires only low privilege and network access via SOAP, making it easy for attackers who can reach the exposed endpoint. The vulnerability is not listed in the CISA KEV catalog. The scope change indicates that a successful attack could also affect associated Fusion Middleware components beyond the BPM module.