A vulnerability exists in the Fabric Layer of Oracle Business Process Management Suite that is easily exploitable by an attacker with low privileges and network access via HTTP. If successfully exploited, the attacker can create, delete, or modify critical data and also gain unauthorized access to all data accessible by the product. The flaw results in high confidentiality and integrity impacts and does not affect availability.

Oracle Corporation’s Oracle Business Process Management Suite is affected. The specific versions impacted are the 12.2.1.4.0 release and the 14.1.2.0.0 release. No other versions are listed as affected.

The CVSS 3.1 base score is 9.6, indicating a severe risk. The EPSS score is not available, but the lack of a KEV listing does not mitigate the high severity or the fact that the vulnerability is easily exploitable over a network. The attack vector is remote via HTTP from a low privileged user, and the vulnerability’s scope change means additional Oracle Fusion Middleware products could be compromised if the attacker gains initial foothold.