Oracle Agile PLM CVE-2026-101595

Requires a valid low-privileged account on Oracle Agile Product Lifecycle Management for Process 6.2.4, specifically reachable access to the Supply Chain Relationship Management component over HTTP (PR:L). Exploitation additionally requires interaction from a different user than the attacker (UI:R) - a victim must view or open the attacker-supplied content for the payload to trigger. Limiting factors: attacker must first authenticate, a separate victim interaction is mandatory, and only version 6.2.4 is listed as affected; these conditions make opportunistic mass exploitation unlikely and favor targeted, insider-style abuse.

This is a medium-severity issue (CVSS 3.1 base 5.4) that should be treated as routine patch-cycle priority rather than an emergency. The vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable but authenticated flaw requiring a low-privileged account (PR:L) AND interaction from a separate victim user (UI:R), which materially raises the bar versus a drop-everything remote-unauthenticated bug. The scope change (S:C) combined with low confidentiality and integrity impact and no availability impact is the classic signature of a stored/reflected cross-site scripting flaw in an Oracle web application - the 'additional products' impact reflects code executing in a victim's authenticated session. No exploitation signals corroborate urgency: there is no CISA KEV listing, no public exploit, and no EPSS score supplied in the input, so there is no evidence of active or widespread exploitation - no public exploit identified at time of analysis. Note a conflict in the metadata: the 'Authentication Bypass' tag contradicts both the PR:L (attacker must already be authenticated) and the C:L/I:L impact profile (an auth bypass would typically yield higher or privilege-level impact); the described behavior is not an authentication bypass. Net: a real but low-to-moderate priority issue, gated by authentication and victim interaction.

A low-privileged authenticated user of Oracle Agile Product Lifecycle Management for Process 6.2.4 submits crafted input to the Supply Chain Relationship Management component over HTTP. When a different, higher-value user later views that content, attacker-controlled script executes in the victim's authenticated context, allowing limited unauthorized read and modification of data and impact crossing into additional products (scope change). No public proof-of-concept exploit is known at time of analysis.