Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Takeover
Action: Assess Impact
AI Analysis

Impact

The flaw in Oracle Agile Product Lifecycle Management for Process version 6.2.4 permits an attacker with low privileges to use HTTP requests to compromise the application, leading to full takeover and loss of confidentiality, integrity, and availability.

Affected Systems

Oracle Corporation’s Oracle Agile Product Lifecycle Management for Process, specifically the Product Quality Management component of version 6.2.4, is affected. Only this version has been identified as vulnerable; no other versions are listed.

Risk and Exploitability

The vulnerability has a CVSS v3.1 base score of 8.8, reflecting high severity. Attackers can exploit it over the network with low complexity and minimal privileges without user interaction. Although the EPSS score is not provided, the lack of a KEV listing does not diminish the potential for damage; the fault allows remote code execution or service takeover, thus presenting a significant risk to any organization running the affected instance.

Generated by OpenCVE AI on October 21, 2026 at 00:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any Oracle patch or update released for version 6.2.4 that addresses this vulnerability.
  • Restrict HTTP access to the Agile application to trusted networks or IP ranges, and enforce firewall rules to limit exposure.
  • Reduce privileges for user accounts that have access to the application, ensuring that only necessary permissions are granted.

Generated by OpenCVE AI on October 21, 2026 at 00:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title Remote Takeover via HTTP in Oracle Agile Product Lifecycle Management for Process 6.2.4
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:46.312Z

Reserved: 2026-09-28T15:40:09.494Z

Link: CVE-2026-101594

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:12.933

Modified: 2026-10-20T22:18:12.933

Link: CVE-2026-101594

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T01:45:14Z

Weaknesses