Oracle Agile PLM CVE-2026-101591

Exploitation requires the attacker to already possess valid low-privileged credentials for Oracle Agile Product Lifecycle Management for Process 6.2.4 and network (HTTP) reachability to the Product Quality Management component; no user interaction is needed. The limiting factors are the authentication requirement (PR:L - an anonymous/unauthenticated attacker cannot exploit it) and the narrow impact (read-only access to a subset of application data, with no write or availability effect), which substantially constrains real-world risk despite the network attack vector.

This is a moderate-severity information-disclosure issue (CVSS 3.1 base 4.3) that is a patch-management item rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity attack but one that requires the attacker to already hold valid low-privileged credentials (PR:L), and the impact is limited to unauthorized read access to a subset of application data (C:L, with no integrity or availability impact). No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified; the absence of these signals is not evidence of safety but does mean there is no indication of active or imminent exploitation. One signal conflicts with the technical data: the input Tags include 'Authentication Bypass,' yet the CVSS vector mandates PR:L (an authenticated attacker) and the impact is read-only, which is inconsistent with a genuine authentication bypass - treat that tag as unreliable. Overall this is a legitimate but lower-priority finding: real because it is network-exploitable with minimal privileges, but not a high-urgency item given the single-confidentiality, partial-data-exposure impact and the prerequisite of existing authenticated access.

An attacker who has obtained a valid low-privileged application account (for example a limited supplier or internal user) sends crafted HTTP requests to the Product Quality Management component of Oracle Agile PLM for Process 6.2.4 and retrieves a subset of application data they are not authorized to see. No public exploit code was identified in the provided data, and the attack requires only network access and valid low-level credentials, with no user interaction needed.