Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Full Compromise
Action: Apply Patch
AI Analysis

Impact

A vulnerability exists in Oracle Agile Product Lifecycle Management for Process 6.2.4, allowing a low‑privileged attacker who can reach the system over HTTP to execute arbitrary code. The flaw is rooted in missing authentication (CWE-306), enabling the attacker to fully takeover the application. Successful exploitation results in complete loss of confidentiality, integrity, and availability of the product and its data.

Affected Systems

Oracle Agile Product Lifecycle Management for Process, version 6.2.4, part of Oracle Supply Chain’s Product Quality Management component, is the affected product. The vulnerability is exposed via standard HTTP interfaces that are reachable over the network.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 denotes a high‑severity issue. Although the EPSS score is reported as less than 1%, indicating a low current exploitation probability, the flaw remains exploitable with ease from the network by a non‑privileged user. The lack of a KEV listing does not mitigate the impact. Organizations that expose the application to external traffic are at significant risk, and timely patching or mitigations are strongly advised.

Generated by OpenCVE AI on October 27, 2026 at 09:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Oracle patch or update that addresses the identified authentication weakness in Agile Product Lifecycle Management for Process 6.2.4.
  • Limit external exposure by configuring network firewalls or VPNs to restrict HTTP access to the application only to trusted internal IP ranges, thereby reducing the attack surface.
  • Disable or secure any features that allow unauthenticated access, and enforce strict authentication and authorization controls to ensure that only privileged users can invoke these capabilities.

Generated by OpenCVE AI on October 27, 2026 at 09:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Authentication Bypass in Oracle Agile Product Lifecycle Management for Process 6.2.4

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Leading to Complete Compromise of Oracle Agile Product Lifecycle Management for Process
Weaknesses CWE-94

Mon, 26 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Leading to Complete Compromise of Oracle Agile Product Lifecycle Management for Process
Weaknesses CWE-94

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T19:56:23.146Z

Reserved: 2026-09-14T22:10:16.641Z

Link: CVE-2026-91521

cve-icon Vulnrichment

Updated: 2026-10-26T19:56:17.687Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:56.127

Modified: 2026-10-26T20:19:46.870

Link: CVE-2026-91521

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:00:15Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function