Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch ASAP
AI Analysis

Impact

The vulnerability in Oracle Agile Product Lifecycle Management for Process allows a low‑privileged attacker with network access via HTTP to compromise the application, potentially enabling full takeover. The flaw is related to improper access control, permitting unauthorized actions and impacting confidentiality, integrity, and availability. A successful exploit can lead to complete control over the system.

Affected Systems

Oracle Corporation's Agile Product Lifecycle Management for Process, version 6.2.4, is affected. Only this version is currently supported with the known issue.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered over a simple HTTP connection with low privileges, the potential for exploitation is significant, particularly in environments with unrestricted network access to the application.

Generated by OpenCVE AI on October 21, 2026 at 12:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle for a patch or upgrade that addresses the 6.2.4 issue and apply it immediately.
  • Limit network exposure of the Agile service by restricting HTTP access to trusted hosts, VPNs, or firewall rules.
  • Enable multi‑factor authentication and enforce the minimum privilege principle for all users interacting with the Product Quality Management component.
  • Monitor application and web server logs for suspicious HTTP activity related to the vulnerable component.

Generated by OpenCVE AI on October 21, 2026 at 12:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Title Oracle Agile Product Lifecycle Management for Process Vulnerability Enables Low‑Privileged Remote Takeover via HTTP
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:16:00.775Z

Reserved: 2026-09-14T22:10:16.643Z

Link: CVE-2026-91550

cve-icon Vulnrichment

Updated: 2026-10-26T20:15:55.611Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:58.320

Modified: 2026-10-26T21:20:44.317

Link: CVE-2026-91550

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:30:09Z

Weaknesses