Oracle Agile PLM for Process 6.2.4 Has Critical Unauthenticated Data Flaw

Oracle Agile Product Lifecycle Management for Process version 6.2.4 contains a critical security vulnerability that allows unauthenticated attackers to compromise the system. The flaw, identified as CVE-2026-91622, carries a CVSS base score of 9.3 according to the National Vulnerability Database.

The vulnerability resides in the Product Quality Management component of the Oracle Supply Chain product suite. Attackers with network access via HTTP can exploit this issue without needing prior authentication credentials. Successful exploitation requires human interaction from a person other than the attacker, such as clicking a malicious link or opening a crafted file.

Technical Details and Impact

The National Vulnerability Database rates the severity of CVE-2026-91622 as Critical based on its CVSS 3.1 vector. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. This indicates that the attack vector is network-based, the attack complexity is low, and no privileges are required. However, user interaction is necessary for the attack to succeed.

Successful attacks can result in unauthorized creation, deletion, or modification of critical data. Attackers may also gain unauthorized access to critical data or complete access to all data accessible within Oracle Agile Product Lifecycle Management for Process. The confidentiality and integrity impacts are both rated as high, while the availability impact is none.

Scope and Affected Systems

The vulnerability is specific to Oracle Agile Product Lifecycle Management for Process version 6.2.4. While the flaw exists within this specific product, the National Vulnerability Database notes that successful attacks may significantly impact additional products due to scope change. This means the consequences of the exploit extend beyond the initial targeted component.

The affected component is Product Quality Management, which is part of the broader Oracle Supply Chain portfolio. Organizations using this specific version of the software are at risk if the system is accessible via HTTP and if users can be induced to interact with malicious content.

What should you do?

Security teams should immediately verify if their environment runs Oracle Agile Product Lifecycle Management for Process version 6.2.4. If this version is in use, organizations should assess the exposure of the Product Quality Management component to untrusted networks. Until a fix is confirmed, limiting network access to this component via HTTP may reduce the attack surface.

What to do and how to stay safe: Oracle

• Inventory systems running Oracle Agile Product Lifecycle Management for Process version 6.2.4 to determine exposure.
• Restrict network access to the Product Quality Management component to trusted internal networks only, blocking external HTTP access if possible.
• Monitor logs for unusual HTTP requests or user interactions that could indicate an exploitation attempt.
• Wait for official vendor guidance or patches before applying unverified mitigations, as no fix has been confirmed yet.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91622?

The CVSS 3.1 Base Score is 9.3, which is rated as Critical.

Does exploiting this vulnerability require authentication?

No, the vulnerability allows unauthenticated attackers to exploit the system, but it does require human interaction from a victim.

Which version of Oracle Agile PLM for Process is affected?

Only version 6.2.4 is listed as affected in the National Vulnerability Database record.