CVE-2026-91520 in Agile Product Lifecycle Management for Process
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process, specifically affecting version 6.2.4. This software is a critical enterprise solution used by manufacturing and process industries to manage product data, quality standards, and compliance documentation throughout the lifecycle of industrial products. The presence of this flaw in such a high-value business application underscores the severity of potential exploitation, as these systems often contain sensitive intellectual property, regulatory records, and operational parameters essential for continuous production cycles.
The technical nature of this vulnerability is characterized by an easily exploitable condition that requires only low-privileged access to trigger. An attacker with network access via HTTP can leverage this flaw without needing any user interaction or complex preconditions. This lack of a required user interface step significantly lowers the barrier to entry for malicious actors, allowing automated exploitation tools to target vulnerable instances efficiently. The vulnerability likely stems from insufficient input validation or improper authorization checks within the web application logic handling product quality data requests over standard HTTP protocols.
The operational impact of successful exploitation is severe, resulting in complete takeover of the Oracle Agile Product Lifecycle Management for Process environment. With a CVSS 3.1 Base Score of 8.8, classified as High severity, this vulnerability affects all three pillars of the CIA triad: Confidentiality, Integrity, and Availability. An attacker gaining control can exfiltrate proprietary product designs and quality metrics, compromising confidentiality. They can also alter critical quality records or production parameters, leading to integrity violations that could result in defective products reaching consumers or regulatory non-compliance. Furthermore, the ability to disrupt service availability means attackers could halt manufacturing operations by rendering the management interface inaccessible or corrupting underlying databases.
From a threat modeling perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-918 SQL Injection if the takeover involves database manipulation, though the specific vector suggests broader application-level flaws such as CWE-601 URL Redirection to Untrusted Site or CWE-434 Unsafe Deserialization depending on the exact mechanism. In terms of MITRE ATT&CK framework mapping, this scenario corresponds to Initial Access techniques involving web-based attacks and Privilege Escalation where low privileges are leveraged to gain higher system control. The network-accessible nature via HTTP indicates exposure through standard ports, making it a prime target for remote exploitation campaigns targeting enterprise supply chain software.
Mitigation strategies must prioritize immediate patching of the Oracle Agile Product Lifecycle Management for Process product to version 6.2.4 or later where this flaw is resolved. Organizations should also implement strict network segmentation to restrict HTTP access to only authorized management subnets if possible, rather than exposing it directly to untrusted networks. Web Application Firewalls can be configured with specific rulesets to detect and block exploit patterns associated with the vulnerability's vector. Additionally, enforcing multi-factor authentication for all user accounts, even low-privileged ones, adds a layer of defense against credential-based attacks that might precede or accompany exploitation of this flaw. Regular security assessments and penetration testing focused on web application logic are recommended to identify similar weaknesses in related components before they can be exploited by adversaries seeking to compromise supply chain integrity.