Oracle Agile PLM CVE-2026-91624

Exploitation requires network HTTP access to an Oracle Agile Product Lifecycle Management for Process 6.2.4 instance, specifically a component within Product Quality Management. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no elevated privileges, and no user interaction are needed, so default-reachable deployments are exploitable by any remote attacker who can reach the HTTP service. The primary limiting factors are therefore network exposure (instances behind VPN/segmentation or not internet-facing are harder to reach) and version - only 6.2.4 is listed as affected. No non-default configuration prerequisite is stated in the description.

The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) signals a genuinely severe issue: a remote, unauthenticated attacker (PR:N) can exploit it over HTTP with low complexity (AC:L) and no user interaction, yielding high confidentiality and integrity impact - Oracle explicitly describes 'easily exploitable.' However, the maturity signals do not corroborate imminent mass exploitation: there is no CISA KEV listing and no public exploit code identified at the time of analysis, and no EPSS score or SSVC decision data was supplied in the input, so exploitation probability cannot be quantified. The only reference is Oracle's October 2026 Critical Patch Update advisory page (cpuoct2026.html), which is a confirmed vendor source but a roll-up page rather than a CVE-specific technical write-up. Net: this is a real, patch-now priority for anyone running the affected product due to the unauthenticated-network attack profile, but the absence of KEV/POC/EPSS means current real-world exploitation is unconfirmed - the urgency derives from exploitability potential and the narrow patched-version window, not from observed attacks. Note the 'Authentication Bypass' tag overstates the mechanism: the CVSS vector shows PR:N (no privileges required), i.e. the function is reachable pre-authentication, which is not necessarily an authentication-bypass defect - verify the mechanism against Oracle's advisory.

An attacker with network reachability to an exposed Oracle Agile Product Lifecycle Management for Process 6.2.4 instance sends crafted HTTP requests to a vulnerable endpoint without any credentials. Because no authentication, privileges, or user interaction are required, the attacker reads or alters critical PLM data - potentially all accessible data - undermining product-quality and supply-chain records. No public proof-of-concept exploit has been identified at the time of analysis, so exploitation would require independent development.