CVE-2026-91565 in Agile Product Lifecycle Management for Process
Summary
by MITRE • 10/22/2026
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process, specifically affecting version 6.2.4. This software is a critical enterprise solution used by organizations to manage product data and quality processes across complex supply chains. The flaw represents a significant security risk because it allows an attacker with low privileges and network access via HTTP to compromise the system. Although the vulnerability is classified as difficult to exploit, its potential impact on confidentiality, integrity, and availability makes it a priority for remediation within affected environments.
From a technical perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, or potentially CWE-78 if input validation failures are involved in the exploitation path. The attack vector is network-based (AV:N), meaning remote attackers can target the system without physical access. However, the high complexity of exploitation (AC:H) suggests that specific conditions or precise sequences must be met to trigger the flaw successfully. This often implies a race condition, a complex state manipulation requirement, or reliance on subtle configuration errors rather than simple injection attacks. The absence of user interaction requirements (UI:N) further indicates that the attack can be automated and executed without tricking an end-user into clicking malicious links or opening files.
The operational impact of this vulnerability is substantial due to its broad scope across confidentiality, integrity, and availability metrics. A successful exploit grants unauthorized access to critical data, which corresponds directly to CWE-200, Information Exposure. This means sensitive product specifications, quality reports, or proprietary manufacturing processes could be exfiltrated by competitors or malicious actors. Furthermore, the vulnerability allows for unauthorized updates, inserts, or deletes of accessible data, mapping to CWE-798 if it involves persistent backdoors or CWE-352 Cross-Site Request Forgery depending on the exact mechanism. This compromises the integrity of the product lifecycle records, potentially leading to flawed manufacturing decisions or regulatory compliance failures.
In addition to data compromise, the vulnerability enables a partial denial of service against Oracle Agile Product Lifecycle Management for Process. This aspect relates to CWE-400 Uncontrolled Resource Consumption and impacts system availability (A:L). While not necessarily causing a complete crash, it can degrade performance significantly enough to disrupt business operations that rely on real-time access to product quality data. The combination of these effects results in a CVSS 3.1 Base Score of 6.4, indicating a medium severity rating that warrants immediate attention given the critical nature of supply chain management systems.
From an adversary perspective, this vulnerability facilitates lateral movement and persistence within an enterprise network if Oracle Agile is integrated with other internal tools. It aligns with ATT&CK technique T1078 Valid Accounts, as it leverages low-privileged credentials to achieve higher levels of access or data manipulation. Attackers could use the compromised system to pivot into more secure zones of the IT infrastructure, especially if the application server has broader network connectivity than intended. The ability to modify quality management data also poses a risk for supply chain attacks, where malicious actors might alter specifications to introduce defective components into production lines without detection.
Mitigation strategies must focus on immediate patching and access control hardening. Oracle should be consulted to apply the latest security patches that address this specific flaw in version 6.2.4. In the interim, network segmentation is critical; the application server hosting Product Quality Management should not be directly exposed to untrusted networks via HTTP. Access must be restricted to authorized internal subnets only, and HTTPS with strong certificate validation should replace plain HTTP connections wherever possible. Additionally, implementing strict input validation on all user-supplied data entering the Product Quality Management module can help mitigate exploitation attempts that rely on malformed inputs or state manipulation.
Security monitoring teams should also enhance detection capabilities for this specific threat vector. Logs related to authentication failures followed by successful low-privilege actions in the Agile system should be flagged as suspicious. Since the vulnerability allows unauthorized updates and deletes, integrity checking mechanisms such as database audit trails can help detect anomalous data modifications that do not align with expected business processes. Regular penetration testing focused on privilege escalation paths within the application layer will further ensure that any residual weaknesses are identified before they can be exploited in a production environment.