Skip to main content

Agile Product Lifecycle Management For Process CVE-2026-21969

CRITICAL
2026-01-20 secalert_us@oracle.com
Oracle Agile Product Lifecycle Management For Process
9.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send unauthenticated HTTP request to Supplier Portal
  2. Exploit
    Exploit unprotected endpoint in component
  3. Execution
    Gain unauthorized access and code execution
  4. Impact
    Achieve complete system compromise

Vulnerability Assessment

Exploitation Conditions

No special conditions — remote unauthenticated exploitation against default configurations of Oracle Agile Product Lifecycle Management for Process version 6.2.4 via Supplier Portal HTTP interface.
Impact

CVSS 9.8 — Oracle PLM systems manage product lifecycle data including formulations, specifications, and supply chain data. Compromise exposes trade secrets and supply chain intelligence.
Exploit ScenarioDerived

An attacker exploits the unauthenticated vulnerability in Agile PLM to access product formulation data, supplier information, and compliance documentation, potentially enabling industrial espionage.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Oracle Agile PLM for Process has a CVSS 9.8 vulnerability in the Supply Chain Sourcing component that allows unauthenticated remote attackers to fully compromise the system.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 9.8

Unauthenticated remote compromise of Oracle Agile PLM for Process.

RemediationAI

Apply Oracle Critical Patch Update. Restrict network access to PLM systems.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Oracle Agile Product Lifecycle Management for Process has a vulnerability in the Supply Chain Sourcing component that allows unauthenticated network-based attackers to take over the system.

Know when Agile Product Lifecycle Management For Process gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

CVE-2026-21969 presents critical security risk rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.2%
Top 52% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*

More in Agile Product Lifecycle Management For Process

View all
CVE-2021-2351 HIGH POC
8.3 Jul 21

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
CVE-2020-11022 MEDIUM POC
6.9 Apr 29

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
CVE-2019-11358 MEDIUM POC
6.1 Apr 20

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
CVE-2026-61183 CRITICAL
9.8 Jul 21

Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthentica
CVE-2026-61178 CRITICAL
9.8 Jul 21

Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remot
CVE-2026-61184 CRITICAL
9.1 Jul 21

Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Manage
CVE-2026-61180 HIGH
8.8 Jul 21

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management compone
CVE-2026-61179 HIGH
8.8 Jul 21

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management compone
CVE-2024-21092 HIGH
8.1 Apr 16

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Pr
CVE-2026-61181 HIGH
7.6 Jul 21

Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management com
CVE-2026-61188 HIGH
7.5 Jul 21

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a l
CVE-2026-61185 HIGH
7.4 Jul 21

Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) all

References

Advisories & patches
ADVISORY https://www.oracle.com/security-alerts/cpujan2026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy