Oracle Agile PLM 6.2.4 Has Critical Unauthenticated Data Manipulation Flaw

Oracle Agile Product Lifecycle Management for Process contains a critical security vulnerability that allows unauthenticated attackers to compromise the system remotely. The National Vulnerability Database records this flaw as CVE-2026-91624, assigning it a CVSS 3.1 Base Score of 9.1. This rating indicates a severe risk to confidentiality and integrity for organizations using the affected software component.

The vulnerability resides within the Product Quality Management component of Oracle Supply Chain’s Agile PLM for Process. According to the NVD record, the issue is easily exploitable by an attacker with network access via HTTP. Successful exploitation results in unauthorized creation, deletion, or modification of critical data. Attackers can also gain unauthorized access to all accessible data within the system.

Technical Details and Severity

The CVSS vector for CVE-2026-91624 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This vector confirms that the attack vector is network-based, requiring low complexity and no user interaction. The privileges required are none, meaning no authentication is needed to trigger the exploit. The impact is high for both confidentiality and integrity, while availability is not affected.

The National Vulnerability Database describes the weakness as allowing an unauthenticated attacker to compromise the Oracle Agile Product Lifecycle Management for Process product. The supported version that is affected is specifically identified as 6.2.4. No other versions are listed in the provided source material as being impacted by this specific CVE entry.

Affected Systems and Scope

Organizations utilizing Oracle Agile Product Lifecycle Management for Process version 6.2.4 are directly exposed to this threat. The Product Quality Management module is the specific component where the vulnerability exists. Because the flaw allows for complete access to all accessible data, the scope of potential damage is broad. Attackers can manipulate critical data without any form of prior authorization.

The ease of exploitation means that any system with network access via HTTP is at risk. There are no restrictions mentioned regarding the attacker’s location or required credentials. This makes the vulnerability particularly dangerous for internet-facing deployments of the affected software version.

What should you do?

Security professionals should immediately verify if their environment includes Oracle Agile Product Lifecycle Management for Process version 6.2.4. If this version is present, the risk is significant due to the unauthenticated nature of the exploit. Organizations should review HTTP traffic logs for unusual activity targeting the Product Quality Management component. Until a fix is confirmed, limiting network access to the affected system may reduce exposure.

What to do and how to stay safe: Oracle

• Audit your inventory to confirm if Oracle Agile Product Lifecycle Management for Process version 6.2.4 is installed.
• Monitor HTTP logs for unauthenticated requests targeting the Product Quality Management component.
• Restrict network access to the affected system to trusted internal networks if possible.
• Watch for official vendor updates or patches addressing CVE-2026-91624.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91624?

The CVSS 3.1 Base Score is 9.1, which is classified as Critical.

Which version of Oracle Agile PLM is affected?

Only version 6.2.4 of Oracle Agile Product Lifecycle Management for Process is listed as affected.

Is authentication required to exploit this vulnerability?

No, the vulnerability allows an unauthenticated attacker to exploit the system via HTTP.