EUVD-2026-106751
GHSA-5m3f-2c6m-4f38
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privileged user
-
ExploitSend crafted HTTP request to Product Quality Management
-
ImpactCompromise and take over PLM application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated, high-privileged account (CVSS PR:H) with network HTTP access to the Oracle Agile Product Lifecycle Management for Process application, specifically version 6.2.4, reaching the Product Quality Management component; no user interaction or special non-default configuration is indicated. The primary limiting factor is the need for pre-existing high-privilege credentials, which restricts this to malicious insiders or attackers who have already compromised a privileged account, rather than anonymous external attackers. |
| Impact | This is a moderate-priority issue whose risk is meaningfully capped by its authentication requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) shows network-reachable, low-complexity exploitation with no user interaction and full confidentiality/integrity/availability impact ('takeover'), but PR:H means the attacker must already hold a high-privileged account on the target - so this is primarily a privilege-escalation/post-authentication abuse rather than a remotely-exploitable entry point. No EPSS score was supplied in the input and the CVE is not listed in CISA KEV; no public exploit code was referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. The signals are internally consistent (network vector with HTTP delivery matches the description), but the PR:H requirement is the dominant mitigating factor: an external unauthenticated attacker cannot trigger this directly. The lone 'Information Disclosure' tag understates the actual impact, which is full CIA takeover per the description. |
| Exploit ScenarioDerived | An attacker who already possesses high-privileged (administrative-level) credentials to the Agile PLM for Process application sends a crafted HTTP request to the Product Quality Management component, abusing the flaw to escalate to full control of the application and its data. No user interaction is required and attack complexity is low. No public proof-of-concept or exploit code was referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle Agile Product Lifecycle Management for Process 6.2.4 can be taken over through its Product Quality Management component by an attacker holding high-privilege credentials and network HTTP access. The CVSS 7.2 rating reflects high confidentiality, integrity, and availability impact, but the PR:H prerequisite confines practical exposure to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
RemediationAI
Apply the fix from Oracle's October 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpuoct2026.html; patch availability is per the vendor advisory, which should be checked for the exact update applicable to Agile PLM for Process 6.2.4. Until patching is complete, restrict HTTP access to the Product Quality Management component to trusted management networks or VPN (trade-off: reduced remote accessibility and added latency), enforce least privilege and just-in-time elevation for high-privilege accounts with MFA (trade-off: operational overhead and potential workflow friction), and monitor privileged account activity for anomalous Product Quality Management operations (trade-off: logging and alerting resource cost).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile PLM for Process is an enterprise product lifecycle and quality management platform; the affected Product Quality Management component is exposed over HTTP. The CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H vector describes a network-reachable, low-complexity attack that requires a high-privileged authenticated account and no user interaction, with scope unchanged and full impact to confidentiality, integrity, and availability. No CWE mapping or CPE identifiers were included in the supplied data, so the precise coding flaw is not publicly classified here; the Oracle October 2026 Critical Patch Update advisory is the authoritative source for affected configurations and fixes.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network HTTP delivery (AV:N) with low complexity and no UI, but Oracle explicitly describes a high-privileged attacker, so PR:H; full takeover yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Agile Product Lifecycle Management for Process 6.2.4 - the platform many process manufacturers use to manage product specifications, formulations, and quality records - can be taken over through its Product Quality Management component, exposing confidential product data and allowing tampering with the quality records that underpin regulatory filings and product safety. The exposure is confined to actors who already hold high-privilege credentials per the CVSS PR:H metric, so the realistic threat is a malicious insider or an attacker who has already compromised a privileged account rather than broad external attack. Leadership should care because a trusted-account compromise of this system would be quiet, would carry high confidentiality, integrity, and availability impact, and would implicate quality and compliance data rather than routine IT assets.
Apply vendor patch (Oracle October 2026 Critical Patch Update). Until it is confirmed on every instance, restrict HTTP access to the Product Quality Management component to trusted networks, enforce least privilege and MFA on high-privilege accounts, rotate privileged credentials, and monitor privileged activity for anomalous changes to quality and specification records.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB