CVE-2026-91624 in Agile Product Lifecycle Management for Process
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process, specifically affecting version 6.2.4. This software is a critical enterprise solution used by organizations to manage product data and quality processes throughout their lifecycle. The flaw represents a significant security deficiency that allows an unauthenticated attacker with network access via HTTP to compromise the integrity and confidentiality of the system. Because the vulnerability does not require user interaction or prior authentication, it presents a high-risk vector for remote exploitation over standard web protocols, potentially allowing adversaries to gain unauthorized control over sensitive operational data without detection by traditional perimeter defenses that rely on identity verification.
The technical nature of this flaw centers on insufficient access controls within the application logic governing product quality management functions. The vulnerability enables an attacker to perform unauthorized creation, deletion, or modification of critical data stored within the Oracle Agile Product Lifecycle Management for Process database. This lack of proper authorization checks means that any entity capable of reaching the HTTP endpoint associated with these functions can manipulate records at will. Furthermore, the flaw extends beyond mere manipulation to include unauthorized access to existing critical data, effectively granting complete read privileges to all accessible information in the system. The absence of authentication requirements for these operations indicates a fundamental failure in implementing secure design principles where sensitive actions are not properly gated behind verified user identities and appropriate role-based permissions.
From an operational perspective, the impact of this vulnerability is severe due to its high CVSS 3.1 Base Score of 9.1, which reflects critical levels of Confidentiality and Integrity impacts while noting that Availability remains unaffected in this specific vector. The ability to modify or delete data can lead to significant business disruption, including corrupted quality records, invalid product specifications, and compromised audit trails essential for regulatory compliance in process industries such as chemicals, pharmaceuticals, and food production. Unauthorized access to critical data exposes proprietary formulas, supplier information, and internal operational metrics to potential competitors or malicious actors. The resulting loss of trust in the system's integrity can have cascading effects on supply chain reliability and product safety assurance processes managed by the platform.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce proper authorization checks for sensitive operations. Additionally, the exploitation method maps to MITRE ATT&CK technique T1078, Valid Accounts, although in this case, the attacker exploits the system without valid credentials by leveraging missing authentication controls entirely, resembling aspects of T1190 Exploit Public-Facing Application. The attack vector is classified as Network (AV:N) with Low Complexity (AC:L), indicating that no specialized conditions or user interaction are required to exploit the flaw once network connectivity is established. This simplicity makes it particularly dangerous in environments where web-facing applications are exposed to untrusted networks without adequate Web Application Firewall rules or input validation mechanisms specifically tuned for this application's behavior.
Mitigation strategies must prioritize immediate remediation through vendor-provided patches if available, as Oracle typically releases security updates to address such critical flaws in supported versions. Organizations should verify their current version against the affected list and apply any recommended hotfixes promptly. In cases where patching is not immediately feasible, network-level controls should be implemented to restrict access to the vulnerable HTTP endpoints exclusively from trusted IP addresses or internal networks. Implementing strict input validation on all user-supplied data entering the Product Quality Management module can also help mitigate potential exploitation vectors related to data manipulation. Regular security assessments and penetration testing focused on authentication bypasses and authorization flaws are recommended to identify similar weaknesses across other components of the Oracle Supply Chain suite before they can be exploited by adversaries seeking to compromise enterprise data integrity.