Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Compromise
Action: Assess Impact
AI Analysis

Impact

A vulnerability in Oracle Agile Product Lifecycle Management for Process, specifically the Product Quality Management component, permits a low‑privileged attacker with network access via HTTP to compromise the application. The flaw can result in a full takeover of the system, affecting confidentiality, integrity and availability. The CVSS 3.1 base score of 8.0 reflects the significant impact a successful exploitation can have.

Affected Systems

Oracle Agile Product Lifecycle Management for Process, version 6.2.4, which is supplied by Oracle Corporation and part of Oracle Supply Chain. No other versions or products are listed as affected.

Risk and Exploitability

The vulnerability is remotely exploitable over HTTP with a low attack complexity and requires user interaction that is not performed by the attacker. The EPSS score is <1%, indicating a very low probability of exploitation, while the CVSS score of 8.0 reflects high severity and the KEV status is not listed. Attacks would typically proceed via a network connection to the application and would require convincing a user other than the attacker to initiate the exploit.

Generated by OpenCVE AI on November 5, 2026 at 22:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle’s security alert for any available patch or upgrade for version 6.2.4 and apply it as soon as possible.
  • Restrict HTTP access to the Oracle Agile Product Lifecycle Management environment, limiting connections to trusted networks or IP ranges.
  • Remediate the Product Quality Management component by disabling it if not required, or monitor for anomalous activity and enforce strict authentication and authorization controls.

Generated by OpenCVE AI on November 5, 2026 at 22:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 05 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote HTTP Exploit Enables Low-Privilege Takeover of Oracle Agile Product Lifecycle Management

Thu, 05 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Title Remote Compromise of Oracle Agile Product Lifecycle Management via HTTP
Weaknesses CWE-269
CWE-285

Thu, 05 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Title Remote Compromise of Oracle Agile Product Lifecycle Management via HTTP
Weaknesses CWE-269
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-05T18:08:25.039Z

Reserved: 2026-09-28T15:40:09.494Z

Link: CVE-2026-101602

cve-icon Vulnrichment

Updated: 2026-11-05T18:06:36.634Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:13.850

Modified: 2026-11-05T19:17:06.527

Link: CVE-2026-101602

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T23:00:12Z

Weaknesses