Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution / System Takeover
Action: Apply Update
AI Analysis

Impact

A flaw in Oracle Agile Product Lifecycle Management for Process 6.2.4 permits a remote attacker with low privileges and network connectivity via HTTP to execute arbitrary code, leading to full takeover of the application. The vulnerability stems solely from improper access control (CWE‑284). Successful exploitation compromises confidentiality, integrity, and availability of the system.

Affected Systems

Oracle Agile Product Lifecycle Management for Process version 6.2.4, part of Oracle Supply Chain’s Product Quality Management component, is the only version explicitly identified as affected.

Risk and Exploitability

The flaw carries a CVSS 3.1 base score of 8.8, indicating high severity. Attackers can reach the vulnerability over the network with low complexity and low privilege requirements. The EPSS score is < 1% and the issue is not currently listed in the CISA KEV catalog, yet the combination of a high CVSS score with minimal attack barriers suggests a significant risk for real‑world exploitation.

Generated by OpenCVE AI on October 27, 2026 at 09:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and apply any available update or patch from Oracle for version 6.2.4 that addresses this vulnerability; if none is yet released, check Oracle’s security site for future fixes.
  • Restrict HTTP access to trusted internal hosts by configuring firewall rules or network segmentation to limit exposure of the application.
  • Monitor application logs for abnormal requests or injection attempts, and configure alerts for suspicious activity that may indicate exploitation attempts.

Generated by OpenCVE AI on October 27, 2026 at 09:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Improper Access Control Enables Remote Code Execution in Oracle Agile Product Lifecycle Management for Process

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in Oracle Agile Product Lifecycle Management for Process 6.2.4
Weaknesses CWE-94

Mon, 26 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in Oracle Agile Product Lifecycle Management for Process 6.2.4
Weaknesses CWE-94

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T19:54:38.372Z

Reserved: 2026-09-14T22:10:16.640Z

Link: CVE-2026-91520

cve-icon Vulnrichment

Updated: 2026-10-26T19:54:31.914Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:56.010

Modified: 2026-10-26T20:19:46.730

Link: CVE-2026-91520

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:00:15Z

Weaknesses