Oracle Agile PLM EUVD-2026-106000

Exploitation requires the attacker to hold valid low-privileged credentials for Oracle Agile Product Lifecycle Management for Process (PR:L) and to deliver content over HTTP to the Product Quality Management component. Crucially, it also requires human interaction from a person other than the attacker (UI:R) - a victim such as another operator, reviewer, or administrator must view or interact with the attacker-supplied content for the attack to succeed. The scope change (S:C) means successful exploitation can significantly impact additional products beyond the PLM application itself. These limiting factors - mandatory authentication plus required victim interaction - meaningfully reduce exploitability versus a fully unauthenticated, no-interaction flaw. Only version 6.2.4 is listed as affected.

This is a medium-severity (CVSS 3.1 base 5.4) vulnerability in Oracle Agile Product Lifecycle Management for Process 6.2.4, disclosed through the Oracle October 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) points to an authenticated, interaction-dependent web flaw - the combination of PR:L, UI:R, scope change (S:C), and low confidentiality/integrity impact with no availability impact is the classic signature of a stored or reflected cross-site scripting issue rather than a direct server compromise. No EPSS score, KEV listing, or public POC is present in the provided data, so there are no signals of active exploitation; the exploitation status is no public exploit identified at time of analysis, and real-world risk is therefore moderate and conditional, not urgent. The 'Authentication Bypass' tag conflicts directly with the CVSS vector: PR:L means the attacker must already hold valid low-privileged credentials, so this is not an authentication bypass - treat that tag as unreliable. Overall this is a genuine but lower-priority issue: patch in the normal Oracle CPU cycle, prioritized below internet-facing unauthenticated RCEs.

A low-privileged authenticated user of the Product Quality Management component injects a malicious payload into a data field; when another user (such as a reviewer or administrator) later opens the affected page, the payload executes in that victim's browser session. Because the scope changes, the resulting script can read a subset of accessible data and perform limited unauthorized inserts, updates, or deletes affecting other products. No public exploit code was identified at time of analysis, so any attack would require custom development.