Oracle Agile PLM CVE-2026-101596

Requires a valid low-privileged authenticated account on Oracle Agile Product Lifecycle Management for Process 6.2.4 (CVSS PR:L), with network HTTP access to the application and specifically its Product Quality Management component. No user interaction is needed and the attack complexity is low. The limiting factors defenders can rely on are: (1) the attacker must first authenticate, so exposure scales with how broadly low-privilege accounts are issued and whether the app is internet-facing; and (2) only version 6.2.4 is listed as affected. No non-default configuration is called out in the description - the component is a standard part of the product.

This is a genuinely high-priority vulnerability by signal convergence, though not the top tier of urgency. The CVSS 3.1 base score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable over HTTP, low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability (complete product takeover). The only meaningful barrier is PR:L, meaning the attacker must already hold a low-privileged authenticated account. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation-probability and in-the-wild signals are ABSENT rather than low - their absence is not evidence of low risk. The signals that ARE present (easy, network-based, authenticated, full takeover) are consistent with each other and with Oracle's own 'easily exploitable' language. One notable inconsistency: the input Tags label this 'Information Disclosure,' yet both the description ('takeover') and the CVSS impact metrics (C:H/I:H/A:H) indicate full compromise, not mere disclosure - treat the tag as understated. Net: a real priority for any organization running the affected version, especially where low-privileged accounts are broadly provisioned, but one notch below 'drop everything' because exploitation requires authentication and no active exploitation is confirmed.

An attacker holding any low-privileged application account (or who has phished/obtained such credentials) sends crafted HTTP requests to the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. Because the flaw is network-reachable, low-complexity, and requires no user interaction, the attacker escalates to full takeover of the application, gaining complete read/write control and the ability to disrupt availability. No public exploit code was identified in the provided data, so an attacker would need to develop the exploit independently.