EUVD-2026-106010
GHSA-xmr2-m4c9-f9pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged app account
-
DeliveryCraft malicious HTTP request/link
-
ExploitDeliver to higher-privileged user
-
ExecutionVictim interaction triggers flaw
-
PersistExecute privileged action in app
-
ImpactFull application takeover
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires (1) the attacker to already hold a low-privileged authenticated account on the Oracle Agile PLM for Process application (PR:L), and (2) human interaction from a different, typically higher-privileged user (UI:R) who must be induced to interact with attacker-supplied content over HTTP. The affected component is Product Quality Management in version 6.2.4. These two conditions - valid credentials plus a second victim's action - are the principal limiting factors: there is no path to unauthenticated, no-interaction remote exploitation, which constrains this to targeted social-engineering-style attacks against authenticated environments rather than opportunistic internet-wide exploitation. |
| Impact | This is a genuinely serious but conditionally-gated flaw. The CVSS 3.1 base score of 8.0 is Oracle-provided and the vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) is internally consistent with the description: network-reachable over HTTP, low attack complexity, but requiring an already-authenticated low-privileged account (PR:L) AND human interaction from a victim other than the attacker (UI:R). These two prerequisites meaningfully reduce the practical risk compared to a true unauthenticated remote takeover. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this currently reads as a high-severity-by-impact but not-yet-weaponized issue. The 'full takeover' claim (C:H/I:H/A:H) elevates priority for any organization running this product, but the PR:L + UI:R gating means exploitation is not a mass, spray-and-pray scenario. CWE is N/A and no vendor advisory detail beyond the Oracle CPU October 2026 bulletin is available, so the precise flaw class (likely a stored-XSS/CSRF-style vector given UI:R, or a request-forgery leading to privileged action) cannot be confirmed from the provided data - verify against the Oracle CPU advisory. |
| Exploit ScenarioDerived | A low-privileged authenticated user of Oracle Agile PLM for Process crafts a malicious HTTP request or link and lures a higher-privileged user (e.g. a product quality manager) into triggering it within the application. When the victim interacts with the crafted content, the attacker leverages the victim's session or privileges to compromise the application, resulting in full takeover of confidentiality, integrity, and availability. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged users can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, but only if a separate, typically higher-privileged victim is induced to interact with attacker-supplied content over HTTP. Rated CVSS 3.1 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), the flaw yields high confidentiality, integrity, and availability impact once the interaction occurs. The dual precondition of valid credentials plus a second user's action confines this to targeted, social-engineering-style attacks against authenticated deployments rather than opportunistic internet-wide scanning; no public exploit code has been identified at time of analysis.
RemediationAI
Apply the fix from the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); Oracle CPU advisories are the vendor's supported patch vehicle, and the exact patched build identifier should be confirmed against that advisory rather than assumed. Because exploitation requires a valid low-privileged account plus a victim's interaction, prioritize reducing both preconditions: restrict network access to the Agile PLM for Process HTTP interface to trusted networks or VPN (trade-off: impedes legitimate remote and partner access), and audit or disable dormant and excess low-privileged accounts in Product Quality Management (trade-off: administrative overhead and possible workflow disruption for legitimate users). Given UI:R, user awareness around unsolicited links and attachments processed inside PLM workflows is a meaningful but non-technical control, and it should not replace patching. Where patching cannot be immediate, monitor Product Quality Management logs for anomalous actions executed under higher-privileged sessions, and treat the deployment as a targeted-attack risk rather than an internet-wide scanning target.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile Product Lifecycle Management for Process is an enterprise PLM suite used in process manufacturing; the affected module, Product Quality Management, is a web-facing workflow area reached over HTTP. The CVSS vector describes a network-reachable, low-complexity flaw that requires a valid low-privileged account (PR:L) and human interaction from a distinct victim (UI:R), with scope unchanged and high impact across confidentiality, integrity, and availability - the profile of a flaw where attacker-supplied content is processed in a higher-privileged user's session, allowing the attacker to inherit that user's rights. No CWE identifier was supplied, so the precise root-cause class (injection, authorization bypass, unsafe content handling, or similar) cannot be confirmed from the available data; the vector alone establishes the prerequisite structure rather than the specific defect. Only version 6.2.4 is listed as supported and affected by the vendor and by ENISA EUVD.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network HTTP vector with low complexity, but requires a low-privileged account (PR:L) and a second user's interaction (UI:R); unchanged scope with full C/I/A takeover.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Agile Product Lifecycle Management for Process 6.2.4 carries a high-severity takeover risk in its Product Quality Management component, but exploitation depends on an authenticated low-privileged account and a higher-privileged user interacting with attacker-supplied HTTP content. This makes the threat most relevant to targeted social-engineering attempts against PLM users rather than broad opportunistic scanning, though a successful attack could materially affect the confidentiality, integrity, and availability of a business-critical product lifecycle platform. Leadership should treat this as a high-priority access-control and user-awareness issue while no vendor patch is available.
No vendor-released patch identified at time of analysis; restrict access to Oracle Agile PLM for Process 6.2.4 and the Product Quality Management component to trusted networks and required users, enforce least privilege, monitor authenticated activity for signs of social-engineering-driven exploitation, and warn users not to interact with untrusted HTTP content or links; temporarily disable or tightly restrict the component if business operations permit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB