CVE-2026-60542 is a vulnerability in the Human Workflow component of Oracle Business Process Management Suite within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an attacker with low privileges and network access via T3 or IIOP to compromise the system, resulting in complete takeover of the Oracle Business Process Management Suite. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning exploitation could impact other Oracle products. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific CVE.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Business Process Management Suite, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via T3 or IIOP protocols. The vulnerability’s scope change indicates that additional Oracle products may also be impacted indirectly. The CVSS score of 9.9 reflects critical impact, potentially allowing attackers to take over the affected system.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until official patches are confirmed and applied, restrict network access to T3 and IIOP services to trusted users only and monitor for unusual activity related to these protocols.