EUVD-2026-106799
GHSA-rr4w-42qg-7522
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySend crafted HTTP request to PQM component
-
ExploitTrigger high-complexity flaw
-
ExecutionEscalate to application takeover
-
ImpactFull compromise of PLM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged account on Oracle Agile Product Lifecycle Management for Process 6.2.4 (PR:L - authenticated per the CVSS vector), network reachability to the application over HTTP (AV:N), and specifically interaction with the Product Quality Management component. Limiting factors: the vulnerability is explicitly rated difficult to exploit (AC:H), meaning success depends on a non-trivial or race/condition-dependent trigger the attacker does not fully control; no user interaction is needed (UI:N) and scope is unchanged (S:U). Only version 6.2.4 is listed as affected. The exact enabling feature or configuration is not disclosed in the Oracle advisory. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:H/PR:L/UI:N - network-reachable over HTTP, but exploitation is explicitly rated high-complexity (AC:H) and requires an already-authenticated low-privileged account (PR:L), which materially lowers real-world risk versus a true pre-auth RCE. The upside for an attacker is severe: full C:H/I:H/A:H, described by Oracle as complete 'takeover' of the product. However, every exploitation-probability signal is either low or absent: no CISA KEV listing, no public POC identified, and no EPSS score was provided in the input - so there is no evidence of active or at-scale exploitation. The AC:H plus PR:L combination means this is more plausible as a targeted, insider-or-foothold-dependent attack than opportunistic mass exploitation. No CWE was supplied (CWE: N/A) and the Oracle CPU advisory gives no technical root-cause detail, so the exact flaw class is unknown. The 'Information Disclosure' tag conflicts with the full C/I/A takeover impact in the description and appears mislabeled - treat the advisory impact text as authoritative over the tag. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged application account (PR:L) sends crafted HTTP requests to the Product Quality Management component of Oracle Agile PLM for Process 6.2.4, chaining a difficult-to-trigger condition (AC:H) to escalate into full compromise of the application. No public exploit code has been identified, and the high attack complexity suggests a non-trivial, likely targeted effort rather than commodity exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Privilege escalation and application takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4: an authenticated attacker holding only low-privileged credentials can reach the Product Quality Management component over HTTP and, if the difficult exploitation conditions are met, gain full control of the application with high confidentiality, integrity and availability impact. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity points to a narrow, condition-dependent trigger rather than a straightforward request. No public exploit code or confirmed active exploitation was identified at time of analysis, and only version 6.2.4 is listed as affected in Oracle's October 2026 Critical Patch Update.
RemediationAI
Oracle addressed this flaw in its October 2026 Critical Patch Update; apply the CPU patch for Agile Product Lifecycle Management for Process 6.2.4 following the advisory at https://www.oracle.com/security-alerts/cpuoct2026.html, and confirm the exact patched build number in that advisory before upgrading since the provided data does not state it. Because exploitation requires only a low-privileged account, reduce exposure by auditing and disabling unnecessary Agile PLM accounts, especially any with Product Quality Management access, and by restricting HTTP access to the application to trusted networks or VPN segments - noting that both measures can disrupt legitimate supplier and shop-floor users if applied too broadly. Where patching must be delayed, monitor for anomalous Product Quality Management transactions originating from low-privilege sessions; this is detective only and does not remove the underlying takeover risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in the Product Quality Management component of Oracle's Agile Product Lifecycle Management for Process, a web-delivered PLM suite used in regulated manufacturing supply chains. Per the assessed vector the attack path is entirely over HTTP (AV:N) and requires a valid low-privileged account (PR:L) but no user interaction (UI:N) and no scope change (S:U). Oracle characterizes the flaw as difficult to exploit (AC:H), implying the winning condition depends on a race, timing, or configuration state the attacker does not fully control; no CWE is assigned in the provided data, so the precise root-cause class (for example authorization bypass, unsafe deserialization, or injection) cannot be confirmed. Successful exploitation yields high impact across confidentiality, integrity and availability, consistent with takeover of the application, and Oracle did not disclose the specific vulnerable endpoint or enabling feature in the advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable (AV:N) but difficult trigger (AC:H) and a required low-privileged account (PR:L); 'takeover' justifies full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Agile Product Lifecycle Management for Process 6.2.4 has a high-severity privilege escalation flaw that could allow an authenticated low-privileged user to take over the application and compromise the confidentiality, integrity, and availability of product quality data. Exploitation requires difficult, condition-dependent steps and no public exploit has been identified at time of analysis, so immediate likelihood is constrained. Leadership should still prioritize this because a successful attack could disrupt quality management operations and expose sensitive product information across the organization.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Product Quality Management component over HTTP, enforcing least privilege and strong authentication for low-privileged accounts, monitoring for anomalous privilege changes, segmenting the Agile PLM application, and applying the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB