Oracle Agile PLM CVE-2026-91515

Exploitation requires the attacker to already hold valid low-privileged credentials to the Oracle Agile Product Lifecycle Management for Process application (PR:L) and network reachability to its HTTP interface, specifically the Product Quality Management component, on the affected 6.2.4 version. No end-user interaction is needed (UI:N). The key limiting factors are the mandatory authenticated foothold and the high attack complexity (AC:H) - Oracle explicitly rates this 'difficult to exploit,' implying success depends on specific timing, state, or conditions beyond the attacker's direct control rather than a single reliable request. These constraints meaningfully reduce real-world risk relative to the 7.5 score for internet-facing but access-controlled deployments.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes network-reachable exploitation over HTTP that nonetheless requires valid low-level credentials (PR:L) AND presents meaningful attacker-side difficulty (AC:H) - Oracle's own language 'Difficult to exploit' corroborates the high complexity. The compensating factor is the full C/I/A=High impact, which Oracle characterizes as complete 'takeover' of the product. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active or opportunistic exploitation; the AC:H + PR:L combination further argues against mass, automatable abuse and points toward targeted exploitation by an actor who already holds a foothold or legitimate account. Note one internal inconsistency: the input Tags label this 'Information Disclosure,' but the vector and description assert integrity and availability compromise amounting to takeover - the tag understates the true impact and should not be used to down-prioritize. Net: patch in the normal quarterly cycle, prioritizing instances exposed to lower-trust internal users, but this is not a drop-everything emergency on current signals.

An attacker possessing low-privileged but valid credentials to the Agile PLM for Process web interface sends a specially crafted HTTP request to the Product Quality Management component and, after overcoming the high exploitation complexity, escalates to full compromise of the application. No public exploit code is available, so this requires a motivated actor rather than a commodity attack. User interaction is not required (UI:N), making a malicious insider or a credential-reuse scenario the most realistic path.