Oracle Agile PLM for Process: Improper access control in Product Quality Management
Summary
Oracle Agile Product Lifecycle Management for Process version 6.2.4 contains an improper access control vulnerability in the Product Quality Management component. An attacker with a low-privileged account and network access via HTTP can take over the product, with high impact on confidentiality, integrity and availability. No user interaction is required. Oracle lists the issue in its October 2026 Critical Patch Update, and the NVD record is still awaiting analysis.
Affected
- Oracle Agile Product Lifecycle Management for Process 6.2.4 (component Product Quality Management)
Fixed in
Unknown. Check the Oracle Patch Availability Document for Supply Chain products and My Oracle Support for the patch number and the fixed 6.2.4 build.
Workaround
- No vendor workaround found in the reviewed sources.
- Until a patch is applied: limit HTTP access to the P4P web tier to internal networks or VPN, review and restrict low-privileged accounts, and monitor Product Quality Management endpoints (general recommendation, not from a source).
Exploitation
- No evidence of exploitation in the wild.
- CISA SSVC in the NVD record: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.00362.
- Public proof of concept: none found in our searches, which does not prove none exists.
- Not found in the CISA KEV catalogue.
Our recommendation
- Verify whether Oracle Agile PLM for Process is in use, including version 6.2.4.
- Apply the Oracle patch from the October 2026 CPU once the fixed build is confirmed.
- Keep the system off the public internet and restrict HTTP access to internal networks or VPN.
- Review and reduce low-privileged accounts, and monitor the Product Quality Management endpoints.
- Treat this as high priority where the product is in use.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle CPU advisory, October 2026 www.oracle.com
- NVD record via OpenCVE app.opencve.io
- NVD mirror (Vulners) vulners.com
- VulDB entry vuldb.com
- VulDB CVE page vuldb.com
- Oracle Agile PLM roadmap docs.oracle.com
- VulDB product description (CVE-2026-91512) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:22.
Original description (NVD)
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.