EUVD-2026-106758
GHSA-gh6f-3jj2-qqgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitSend crafted HTTP request to Product Quality Management
-
ExecutionExploit flaw to escalate access
-
ImpactAchieve full application takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to possess a valid low-privileged account on the target (CVSS PR:L), with network/HTTP reachability to the Oracle Agile Product Lifecycle Management for Process 6.2.4 application and specifically its Product Quality Management component. No user interaction is required (UI:N) and attack complexity is low (AC:L), so a single authenticated actor can reach the vulnerable function directly. Limiting factors: the vulnerability is confined to version 6.2.4, exploitation is gated by needing authenticated (low-privilege) access rather than being fully unauthenticated, and the subsequent affected scope is unchanged (S:U), so impact is bounded to the vulnerable application itself. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-exploitable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability compromise ('takeover'). All signals here derive from a single source (Oracle's October 2026 CPU); there is no EPSS score, no CISA KEV listing, and no public POC referenced, so this is not confirmed as actively exploited. Risk is therefore driven by severity potential rather than evidence of in-the-wild activity: the metrics support high priority for any organization running the affected version, but the absence of EPSS/KEV/POC signals suggests patch urgency should be weighed against the product's limited deployment footprint and the PR:L requirement, which means an attacker must already hold a valid (even low-privileged) application account. Note a conflict between the input Tags ('Information Disclosure') and the actual impact profile: C:H/I:H/A:H and the word 'takeover' indicate full compromise, not mere disclosure - treat 'Information Disclosure' as an incomplete characterization. |
| Exploit ScenarioDerived | An attacker holding a low-privileged account on an internet- or network-reachable Oracle Agile PLM for Process 6.2.4 instance sends crafted HTTP requests to the Product Quality Management component to escalate from limited access to full application takeover. No user interaction or social engineering is needed, and attack complexity is low. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated low-privileged attackers can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to the Product Quality Management component. The flaw is network-exploitable, requires no user interaction, and yields complete compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Apply the October 2026 Oracle Critical Patch Update (CPU) for Oracle Agile Product Lifecycle Management for Process, which contains the fix for CVE-2026-91521; consult the advisory at https://www.oracle.com/security-alerts/cpuoct2026.html for the exact patch or version. If immediate patching is not possible, restrict network access to the Agile PLM application-particularly the Product Quality Management component-to trusted networks or VPNs, and enforce least privilege by limiting low-privileged accounts. Monitor HTTP logs for anomalous requests from authenticated users targeting quality management endpoints. Disabling or limiting access to the affected component may reduce functionality for legitimate quality management workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile Product Lifecycle Management for Process is a supply-chain product quality management solution. The vulnerability resides in the Product Quality Management component of version 6.2.4. No CWE is assigned, and the input tags mention 'Information Disclosure,' but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a more severe flaw enabling an authenticated low-privileged user to fully compromise the application's confidentiality, integrity, and availability. The root cause likely involves improper authorization or input validation in an HTTP endpoint reachable by authenticated users, allowing privilege escalation or remote code execution. The attack requires only a valid low-privileged account and network access to the application.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N) with low complexity (AC:L) and a required low-privilege account (PR:L, not PR:N), no user interaction, yielding full C/I/A takeover within an unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Agile Product Lifecycle Management for Process 6.2.4 presents a high-severity exposure in which low-privileged users can fully compromise the product quality management environment, putting product data, intellectual property, and operational continuity at risk. Leadership should care because the flaw affects a business-critical PLM platform, no vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis-so exposure reduction and monitoring are the immediate priorities.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the Product Quality Management component, enforcing least privilege for Oracle Agile PLM for Process 6.2.4 users, segmenting the application from untrusted networks, deploying WAF/IPS rules to inspect crafted HTTP requests, and monitoring logs for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB