Oracle Agile PLM for Process: Improper access control in Product Quality Management
Summary
Oracle Agile Product Lifecycle Management for Process version 6.2.4, component Product Quality Management, contains an access control flaw (CWE-284) that is reachable over HTTP. An attacker with network access and a valid low-privilege account can take over the application, with high impact on confidentiality, integrity and availability (CVSS 8.8). Oracle does not indicate that the flaw can be exploited without authentication. Systems exposed to the internet are at the highest risk.
Affected
- Oracle Agile Product Lifecycle Management for Process 6.2.4 (supported version per Oracle)
- Component: Product Quality Management
Fixed in
Unknown.
- The patch identifier and fixed release were not confirmed. Check Oracle's October 2026 Supply Chain patch availability documentation.
Workaround
- No vendor workaround found.
- Keep the PLM web interface off the public internet.
- Limit HTTP access to VPN or internal networks and to users who need it.
- Segment the application from untrusted networks.
Exploitation
- Exploited in the wild: none found.
- Not listed in CISA KEV; CISA SSVC data shows exploitation 'none' and automatable 'no'.
- Public proof of concept: none found in our searches, which does not rule out that one exists.
Our recommendation
- Check whether any client runs Agile PLM for Process 6.2.4 and whether its web interface is reachable from the internet.
- Restrict access to VPN or internal networks until a fix is applied.
- Obtain the fixed version from Oracle's October 2026 patch documentation and patch the whole PLM component, including CVE-2026-91622 and CVE-2026-91624 from the same Critical Patch Update.
- Monitor application logs for unusual HTTP requests to Product Quality Management paths.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- VulDB CVE-2026-91520 vuldb.com
- OpenCVE CVE-2026-91520 app.opencve.io
- Strix CVE-2026-91520 www.strix.ai
- SentinelOne CVE-2026-61184 (sibling Agile PLM advisory) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:24.
Original description (NVD)
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.