Oracle Agile PLM for Process: Vulnerability in Product Quality Management
Summary
Oracle Agile Product Lifecycle Management for Process version 6.2.4, component Product Quality Management, is affected. An attacker with low privileges and network access via HTTP can create, modify or delete critical data and partially disrupt the service. A valid user account is required and no user interaction is needed. Oracle rates the CVSS 3.1 base score at 8.3 (High).
Affected
- Oracle Agile Product Lifecycle Management for Process 6.2.4 (component Product Quality Management)
Fixed in
Unknown. No fixed version or patch for 6.2.4 has been confirmed. Do not assume that the Agile PLM 9.3.6 fixes apply; check the Oracle October 2026 advisory.
Workaround
Unknown. No vendor workaround was found in the sources reviewed.
- Own recommendation, not vendor guidance: limit HTTP access to the PLM application to internal networks or VPN.
- Remove unused accounts.
Exploitation
Unknown. No exploitation in the wild and no public proof of concept were found. CISA SSVC: exploitation none, not automatable, partial technical impact. EPSS and KEV status not found.
Our recommendation
- If you run Agile PLM for Process 6.2.4, treat this as high priority.
- Confirm the fixed version in the Oracle October 2026 Critical Patch Update advisory and apply it.
- Restrict HTTP access to internal networks or VPN and review user accounts.
- Monitor PLM access logs for unusual create, modify or delete activity.
- If you do not run this product, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
- Oracle Blog: Critical Patch Update for October 2026 now available blogs.oracle.com
- Oracle Security Alerts index (Rev 2 updates) www.oracle.com
- Strix CVE record CVE-2026-101593 www.strix.ai
- Vulners NVD record CVE-2026-101593 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:32.
Original description (NVD)
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.