CVE-2026-91573 in Agile Product Lifecycle Management for Process
Summary
by MITRE • 10/22/2026
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process, specifically affecting version 6.2.4. This software is a critical enterprise solution used by organizations to manage product data and quality processes across complex supply chains. The flaw represents a significant security gap that allows an unauthenticated attacker with network access via HTTP to compromise the integrity and confidentiality of the system. Because the vulnerability does not require user interaction or prior authentication, it presents a high-risk vector for remote exploitation over standard web protocols, potentially exposing sensitive intellectual property and operational data to malicious actors on the same network segment or the public internet if exposed.
The technical nature of this flaw centers around insufficient access control mechanisms within the application logic governing product quality management functions. The vulnerability enables unauthorized entities to perform actions that should be restricted to authenticated users with specific privileges. Specifically, an attacker can exploit this weakness to read critical data stored in the database without valid credentials, leading to a high impact on confidentiality. Furthermore, the flaw permits unauthorized updates, inserts, and deletes against accessible data, which directly impacts system integrity. This capability allows attackers to alter quality records, manipulate product specifications, or delete essential operational logs, thereby undermining the reliability of the entire lifecycle management process. The absence of proper authentication checks for these specific endpoints is a classic example of broken access control, where the application fails to enforce appropriate restrictions on unauthenticated users.
From an industry standards perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, and CWE-918, which refers to Server-Side Request Forgery if the exploitation involves leveraging internal services, though the primary classification here is unauthorized access due to missing authentication checks. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques related to Initial Access through web applications and potentially Credential Access or Data Exfiltration depending on how the attacker leverages the initial foothold. The CVSS 3.1 base score of 8.2 reflects a High severity rating, driven by the Network attack vector, Low complexity, No required privileges for the attacker, and User interaction not being needed. The impact scores highlight that while Availability is unaffected, Confidentiality suffers a high impact due to data exposure, and Integrity suffers a low-to-medium impact due to potential data modification.
The operational impact of this vulnerability extends beyond immediate data theft or corruption. For organizations relying on Oracle Agile PLM for Process, the compromise can lead to regulatory non-compliance if quality records are altered or deleted without audit trails. It also poses a risk of supply chain disruption if product specifications are maliciously changed, leading to the production of defective goods. Additionally, this vulnerability could serve as an entry point for further lateral movement within the corporate network if the PLM server is integrated with other internal systems that trust its outputs or share credentials. Attackers may use the compromised data to craft more targeted phishing attacks against employees who manage these products, leveraging the insider knowledge gained from accessing critical business information.
Mitigation strategies must prioritize immediate remediation through vendor-provided patches and updates. Organizations should apply the latest security fixes released by Oracle for version 6.2.4 or upgrade to a supported version that addresses this access control flaw. In environments where patching is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to block requests targeting the vulnerable endpoints identified in the advisory. Access restrictions should also be enforced at the infrastructure level, ensuring that only authorized IP ranges can reach the PLM application servers via HTTP or HTTPS. Regular vulnerability scanning and penetration testing are recommended to identify similar misconfigurations across other components of the Oracle Supply Chain suite. Furthermore, implementing strict logging and monitoring for unauthorized access attempts will aid in early detection and incident response efforts should an exploitation attempt occur.