CVE Tools
Track your stack

Business Process Management Suite

41 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Business Process Management Suite, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Business Process Management Suite CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Business Process Management Suite CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-041
2026-050
2026-060
2026-071
2026-080
2026-090
2026-105
2026-110

Severity

How the 41 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1434%
  • High1639%
  • Medium1127%

Latest CVEs

The 15 most recently published vulnerabilities affecting Business Process Management Suite.

  1. CVE-2026-91358Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management Service (11g+)). Supported versions that are affected are 12.2.1.4.0 ...8.2
  2. CVE-2026-91243Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Ea...9.6
  3. CVE-2026-91222Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)). Supported versions that are affected are 12.2.1.4.0 and 14.1....9.9
  4. CVE-2026-91220Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. ...9.8
  5. CVE-2026-91213Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Ea...8.8
  6. CVE-2026-60542Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. ...9.9
  7. CVE-2026-34284Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2....6.1
  8. CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.8.8
  9. CVE-2022-23305SQL injection in JDBC Appender in Apache Log4j V19.8
  10. CVE-2022-23302Deserialization of untrusted data in JMSSink in Apache Log4j 1.x8.8
  11. CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.27.5
  12. CVE-2021-37714Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions7.5
  13. CVE-2021-36090Apache Commons Compress 1.0 to 1.20 denial of service vulnerability7.5
  14. CVE-2021-35517Apache Commons Compress 1.1 to 1.20 denial of service vulnerability7.5
  15. CVE-2021-35516Apache Commons Compress 1.6 to 1.20 denial of service vulnerability7.5

Product grouping is registry-driven, with AI assist and human review. How it works