CVE-2026-60542: Critical severity Oracle Oracle Business Process Management Suite vulnerability
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60542?
CVE-2026-60542 has a critical severity rating of 9.9.
How do I fix CVE-2026-60542?
To fix CVE-2026-60542, apply the recommended patches provided by Oracle for the affected versions.
Which versions are affected by CVE-2026-60542?
The affected versions of Oracle Business Process Management Suite are 12.2.1.4.0 and 14.1.2.0.0.
What type of attackers can exploit CVE-2026-60542?
CVE-2026-60542 can be easily exploited by low privileged attackers with network access via T3 and IIOP.
What components of Oracle Fusion Middleware are impacted by CVE-2026-60542?
CVE-2026-60542 impacts the Human Workflow component of the Oracle Business Process Management Suite.