Oracle Agile PLM for Process: Missing authentication in Product Quality Management
Summary
Oracle Agile Product Lifecycle Management for Process version 6.2.4, component Product Quality Management, contains a flaw that lacks authentication for a critical function (CWE-306). An unauthenticated attacker with network access via HTTP can exploit it with low complexity and no user interaction. Successful attacks can lead to unauthorized read access to critical data, possibly to all data accessible to the application, and limited unauthorized modification or deletion of some data.
Affected
- Oracle Agile Product Lifecycle Management for Process 6.2.4 (component: Product Quality Management)
- Other versions: Unknown.
Fixed in
Unknown. No fixed version or patch identifier was found. Check the Oracle October 2026 Critical Patch Update advisory and My Oracle Support for the patch for P4P 6.2.4.
Workaround
- No vendor workaround found.
- Restrict network access to the P4P web interface (HTTP) to trusted networks or VPN until Oracle confirms a fix.
- Do not expose the P4P web interface to the internet.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- EPSS very low (0.00000).
- No public proof of concept found; this does not prove that none exists.
Our recommendation
- Check whether P4P is installed and whether its HTTP interface is reachable from the internet; if so, treat as urgent.
- Restrict access to trusted networks or VPN now.
- Obtain and apply the P4P 6.2.4 patch from Oracle as soon as it is available, and patch the whole product, as related P4P 6.2.4 CVEs were published the same day.
- Monitor web access logs for unusual requests to the P4P interface.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- VulDB: CVE-2026-91625 vuldb.com
- OpenCVE: CVE-2026-91625 app.opencve.io
- Oracle Agile PLM documentation index www.oracle.com
- Oracle Security Alert: September 2026 CSPU www.oracle.com
- Oracle Product Lifecycle Management for Process roadmap docs.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:23.
Original description (NVD)
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.