Oracle Agile PLM CVE-2026-91625

Exploitation requires only network access to the HTTP interface of Oracle Agile Product Lifecycle Management for Process version 6.2.4, specifically the Product Quality Management component; no authentication, credentials, elevated privileges, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factors are version-specificity (only 6.2.4 is listed as affected) and deployment exposure - the PLM web interface must be reachable by the attacker, and organizations that keep this internal supply-chain application off the public internet or behind VPN/network segmentation substantially reduce exposure. There is no availability impact, so this is a data-confidentiality/integrity risk rather than a service-disruption risk.

This is a genuinely high-priority vulnerability on technical merits, though exploitation signals are currently absent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case access profile: network-reachable over HTTP, low attack complexity, no privileges, and no user interaction, yielding an 8.2 base score driven by high confidentiality impact (C:H) and partial integrity impact (I:L) with no availability impact (A:N). Against those access metrics, no EPSS probability was provided, the CVE is NOT listed in CISA KEV, and no public exploit code was identified - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical takeaway: the access conditions are ideal for an attacker, but the real-world exploitation signals (KEV/EPSS/POC) are all empty, which is typical for a freshly disclosed Oracle Critical Patch Update item where a vendor patch exists before any weaponization. No SSVC decision data was supplied. One metadata caveat: the input Tags include 'Authentication Bypass', yet the Oracle description characterizes the flaw as an unauthenticated data-access issue rather than a bypass of an authentication control - treat that tag as unverified and rely on the CVSS PR:N / 'unauthenticated attacker' language instead.

An unauthenticated attacker who can reach the Oracle Agile PLM for Process web interface over HTTP sends crafted requests to the Product Quality Management component and retrieves or alters application data without any credentials or user interaction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no special timing or conditions. No public proof-of-concept or exploit code has been identified, so exploitation would currently require independent development.