EUVD-2026-106001
GHSA-wrqm-7mqc-chfp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged app account
-
ExploitSend crafted HTTP request to PQM
-
ExecutionExploit flaw in Product Quality Management
-
ImpactRead or modify critical PLM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network/HTTP access to the Oracle Agile Product Lifecycle Management for Process application and (2) a valid low-privileged account on it (CVSS PR:L) - it is NOT remote-unauthenticated. The affected surface is specifically the Product Quality Management component of version 6.2.4. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is straightforward against default configurations. The primary limiting factors are the authentication requirement and the narrow deployment base of this specialized supply-chain product; exposure increases where the application is internet-facing or where low-privilege accounts are widely provisioned to suppliers or partners. |
| Impact | This is a genuinely high-priority vulnerability for organizations running the affected product, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, base 8.3) indicates a network-reachable flaw over HTTP with low attack complexity, no user interaction, and only low-level privileges required (PR:L) - Oracle characterizes it as 'easily exploitable.' Impact is severe on confidentiality and integrity (C:H/I:H) with partial availability loss (A:L). The authentication requirement (PR:L - an attacker needs a valid low-privileged account) is the main mitigating factor and places this below an unauthenticated-RCE tier. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public proof-of-concept was referenced, so there is no public exploit identified at time of analysis; this tempers immediate urgency and suggests the risk is latent rather than actively weaponized. Note a conflict in the input: the 'Authentication Bypass' tag contradicts the CVSS PR:L and the description's explicit 'low privileged attacker' language - the vulnerability requires authentication, it is not an auth bypass; treat that tag as unreliable. Overall: patch promptly as part of the October 2026 Oracle CPU, but the authentication prerequisite and absence of exploitation signals mean it is not a drop-everything zero-day. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged application account (for example, a supplier or internal user with limited access) sends crafted HTTP requests to the Product Quality Management component of Oracle Agile PLM for Process. Because attack complexity is low and no user interaction is needed, the attacker reads or alters critical product/quality data across the application and can induce a partial denial of service. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged users can read, modify, and delete critical Product Quality Management data in Oracle Agile Product Lifecycle Management for Process 6.2.4, and can additionally degrade availability, giving the issue a CVSS 3.1 base score of 8.3. The flaw is reachable over the network via HTTP, requires only a valid low-privilege account (PR:L), needs no user interaction, and has low attack complexity, so exploitation is straightforward once an attacker holds credentials. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the main practical constraints are the authentication prerequisite and the narrow deployment base of this specialized supply-chain product.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 referenced at https://www.oracle.com/security-alerts/cpuoct2026.html; the supplied data does not state an exact fixed version number, so confirm the patched build for 6.2.4 against the advisory before upgrading. Where patching must be staged, reduce exposure by restricting network access to the Agile PLM HTTP interface to trusted networks, supplier VPNs, or a reverse proxy with allow-listed source ranges - accepting that this limits the supplier and partner workflows the product is designed for. Enforce strong authentication and MFA on all accounts, and immediately review and prune low-privilege accounts, especially those provisioned to suppliers or partners, since a valid low-privilege login is the only prerequisite beyond network reach. Add monitoring and alerting for anomalous Product Quality Management reads, bulk record changes, or deletions by low-privilege users, and test detection rules against known-normal change patterns to limit false positives. Trade-off: none of these controls removes the underlying authorization weakness, so they only buy time until the CPU is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile Product Lifecycle Management for Process is Oracle's web-based supply-chain suite for product quality, specification, and compliance workflows; the affected component is Product Quality Management within version 6.2.4. The vulnerability is exposed through the application's HTTP interface and, per the CVSS vector (AV:N/AC:L/PR:L/UI:N), is reachable by any authenticated low-privilege user without user interaction and with no special attack complexity. No CWE identifier was supplied, so the precise root-cause class is not published, but the high confidentiality and integrity impact combined with only low privileges strongly indicates missing or insufficient authorization checks on Product Quality Management functionality - that is, a low-privilege account can perform operations and reach records that should be reserved for more privileged roles. The availability impact is partial (A:L), consistent with a feature-level disruption rather than full service shutdown. No CPE strings were provided in the source data, so affected-product identification relies on the vendor advisory and the ENISA EUVD entry naming version 6.2.4.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Network HTTP vector with low complexity and no UI; requires a low-privileged account (PR:L); high confidentiality/integrity loss and only partial DoS (A:L).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
Executive ViewAI
Oracle Agile Product Lifecycle Management for Process 6.2.4 can allow any holder of a low-privilege account to read, alter, or delete critical Product Quality Management records and degrade availability, creating quality, compliance, and supply-chain risk for organizations running this specialized platform. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should prioritize access controls, monitoring, and network exposure reduction for affected deployments. The risk is concentrated in the narrow set of organizations that operate this product, but for those organizations the integrity of quality data is business-critical.
No vendor-released patch identified at time of analysis; interim controls include restricting network access to the HTTP interface, enforcing least privilege and account reviews, disabling unused low-privilege accounts, enabling audit logging and alerting on Product Quality Management data changes, segmenting the 6.2.4 deployment, maintaining validated offline backups, and engaging Oracle support for patch guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB