CVE-2026-91622 in Agile Product Lifecycle Management for Process
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process, specifically affecting version 6.2.4 which is part of the broader Oracle Supply Chain suite. This security flaw represents a significant risk to organizations relying on this platform for managing product quality data and lifecycle processes. The core technical issue stems from an easily exploitable vulnerability that permits unauthenticated attackers with network access via HTTP to compromise the system. Unlike many modern vulnerabilities that require complex exploitation chains or specific configuration errors, this defect allows for straightforward exploitation by any remote actor who can reach the affected service over standard web protocols.
A critical characteristic of this vulnerability is its reliance on human interaction from a victim other than the attacker. This indicates that the attack vector likely involves social engineering tactics such as phishing or malicious link injection, where an unsuspecting user must perform an action to trigger the exploit. Despite requiring this initial step, the subsequent exploitation phase does not demand authentication credentials, allowing the attacker to bypass standard access controls once the victim interacts with the malicious payload. This combination of low complexity and lack of required privileges makes it a high-severity threat that can be leveraged by less sophisticated adversaries who might otherwise struggle against authenticated systems.
The operational impact of successful exploitation is severe, characterized by broad unauthorized access to critical data within the Oracle Agile environment. Attackers can achieve complete read access to all accessible data as well as perform unauthorized creation, deletion, or modification operations on this information. This level of control effectively grants an attacker administrative-level privileges over the application's database and file systems without needing valid user accounts. The scope change noted in the advisory suggests that compromising Oracle Agile Product Lifecycle Management for Process can lead to lateral movement or impact additional connected products within the enterprise ecosystem, thereby expanding the blast radius beyond the immediate application boundary.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Cross-Site Scripting (XSS) vulnerabilities where untrusted data is not properly validated before being sent to web users, often leading to code execution in the context of the vulnerable website. It also maps closely to ATT&CK technique T1059, Command and Scripting Interpreter, if the exploitation allows for arbitrary command execution on the server side, or potentially T1189 Drive-by Compromise given the requirement for user interaction via HTTP. The high confidentiality and integrity impacts reflected in the CVSS score underscore the potential for significant data breaches and corruption of critical business records managed by the platform.
To mitigate this risk, organizations running Oracle Agile Product Lifecycle Management for Process version 6.2.4 must apply the relevant security patches provided by Oracle immediately. Until patching is feasible, implementing strict network segmentation to restrict HTTP access from untrusted networks can reduce exposure. Additionally, deploying web application firewalls with rules designed to detect and block common exploitation patterns associated with this vulnerability type may provide a layer of defense. User awareness training should also be reinforced to help employees recognize and avoid suspicious links or attachments that could trigger the initial interaction required for exploitation. Regular audits of access logs can aid in detecting any attempted unauthorized interactions early, allowing for rapid incident response before data is compromised.