Oracle Agile PLM CVE-2026-91520

Exploitation requires a valid low-privileged account on the Oracle Agile Product Lifecycle Management for Process application (PR:L) with network HTTP access to the Product Quality Management component; it applies to supported version 6.2.4. No user interaction or non-default configuration is needed (UI:N, AC:L), and Oracle labels it 'easily exploitable,' so the primary limiting factor is the need for authenticated access - any user with even minimal application privileges can achieve full takeover, making internal users and compromised low-tier credentials the realistic threat vector rather than fully anonymous attackers.

This is a genuinely high-priority vulnerability on paper: the Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing only a low-privileged account and no user interaction, yielding full confidentiality, integrity, and availability compromise - Oracle explicitly characterizes it as 'easily exploitable' resulting in 'takeover' of the product. However, the real-world exploitation signals are weak or absent: there is no CISA KEV listing, no public proof-of-concept, and no EPSS score provided in the input, so there is no public exploit identified at time of analysis. The conflict to note explicitly is between the severe technical scoring and the lack of any exploitation evidence - this reflects a standard Oracle Critical Patch Update advisory disclosure rather than observed in-the-wild activity, so treat it as a patch-urgently-but-not-emergency item. One caveat: the input Tag 'Information Disclosure' understates the impact, since the description and CVSS vector indicate full takeover (C:H/I:H/A:H), not mere disclosure - rely on the CVSS vector, not the tag, for triage.

An attacker who already holds a low-privileged application account on an internet- or intranet-reachable Oracle Agile PLM for Process 6.2.4 instance sends crafted HTTP requests to the Product Quality Management component to escalate into full control of the application. Because attack complexity is low and no user interaction is required, exploitation is straightforward once valid low-level credentials are obtained. No public exploit code has been identified at time of analysis.