This vulnerability exists in the Human Workflow 11g+ component of Oracle Business Process Management Suite. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with impacts on confidentiality and integrity. Exploitation can result in unauthorized modification and disclosure of certain accessible data within the affected product. The scope of impact may extend to additional Oracle products due to the suite's integration. Oracle's April 2026 Critical Patch Update advisory includes patches addressing this vulnerability among 481 others across multiple product families.

Successful exploitation can lead to unauthorized update, insertion, or deletion of some data accessible via Oracle Business Process Management Suite, as well as unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires human interaction from a user other than the attacker, which limits automated exploitation. There are no known exploits in the wild at the time of publication.

Oracle has released security patches for this vulnerability as part of its April 2026 Critical Patch Update for Fusion Middleware products, which includes Oracle Business Process Management Suite. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. No alternative mitigations or temporary fixes are specified. Patch status is confirmed by the vendor advisory. Organizations should ensure they remain on actively supported versions and apply Critical Patch Updates without delay.