Oracle Agile PLM CVE-2026-91573

Exploitation requires network reachability to the HTTP interface of Oracle Agile Product Lifecycle Management for Process version 6.2.4, specifically the Product Quality Management component; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are indicated as prerequisites. The primary limiting factor is deployment exposure: Agile PLM for Process is typically an internal enterprise application, so risk is materially higher where the web interface is reachable from untrusted or internet-facing networks and lower where it sits behind VPN/segmentation. The specific vulnerable feature or request within Product Quality Management is not detailed in the available data.

This is a credible mid-to-high priority for organizations actually running Oracle Agile Product Lifecycle Management for Process 6.2.4. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case access profile: network-reachable over HTTP, low complexity, no privileges, and no user interaction, yielding an 8.2 base score driven by high confidentiality impact (C:H) and partial integrity impact (I:L) with no availability impact (A:N). That combination means an unauthenticated remote attacker could read all accessible data and perform some unauthorized writes. However, several real-world risk signals are MISSING from the input and must be stated plainly: there is no EPSS exploitation-probability score provided, the CVE is NOT listed in CISA KEV, and no public POC is referenced. The only source is the Oracle October 2026 Critical Patch Update advisory. So while the theoretical severity is high, there is no evidence of active or imminent exploitation, and Oracle CPU entries are routinely patched before any public exploit emerges. The 'Authentication Bypass' tag is not corroborated by the description - the flaw is simply pre-authentication (PR:N), which is not the same as bypassing an authentication mechanism; treat that tag as unverified. Net: prioritize patching because it is unauthenticated and high-impact, but current evidence points to this being a high-CVSS issue without confirmed real-world exploitation rather than an urgent emergency.

An attacker with network access to the Agile PLM for Process web interface sends crafted HTTP requests to the Product Quality Management component without any credentials, gaining unauthorized access to sensitive product, supplier, and quality data and performing limited unauthorized inserts, updates, or deletes. No public exploit code or proof-of-concept is referenced in the provided data, and the low attack complexity means exploitation would be straightforward if a working technique were developed.