Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Takeover of Oracle Agile Product Lifecycle Management for Process
Action: Patch Now
AI Analysis

Impact

A vulnerability exists in Oracle Agile Product Lifecycle Management for Process version 6.2.4 that allows an attacker with high privileges to compromise the system over HTTP. The flaw can lead to full takeover, resulting in the loss of confidentiality, integrity, and availability of the application and its underlying data, as reflected in a CVSS score of 7.2.

Affected Systems

Oracle Corporation’s Agile Product Lifecycle Management for Process is affected for version 6.2.4.

Risk and Exploitability

The CVSS vector indicates a network‑based attack requiring low effort and high privileges, with no user interaction needed. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, it has not yet been documented as a known exploit. However, the high impact score and the ability to achieve a full takeover make it a significant risk for any organization still running this version.

Generated by OpenCVE AI on October 21, 2026 at 10:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle patch for version 6.2.4 from the referenced security alert.
  • Restrict HTTP access to the Oracle Agile application to trusted IP ranges or network segments.
  • Enforce strict access controls or role‑based authentication on the exposed HTTP endpoints.

Generated by OpenCVE AI on October 21, 2026 at 10:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title High‑Privilege Remote Exploitation in Oracle Agile Product Lifecycle Management 6.2.4
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T19:45:44.629Z

Reserved: 2026-09-14T22:10:16.639Z

Link: CVE-2026-91512

cve-icon Vulnrichment

Updated: 2026-10-26T19:45:37.219Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:55.337

Modified: 2026-10-26T20:19:45.797

Link: CVE-2026-91512

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:30:08Z

Weaknesses