CVE-2026-91625 in Agile Product Lifecycle Management for Process
Summary
by MITRE • 10/22/2026
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process, specifically affecting version 6.2.4. This software is a critical enterprise solution used by organizations to manage product data and quality processes across complex supply chains. The flaw represents a significant security deficiency that undermines the integrity and confidentiality of sensitive manufacturing and operational data managed by this platform. As an unauthenticated vulnerability accessible via HTTP, it poses a severe risk to any deployment where the application interface is exposed to network traffic without sufficient access controls or encryption layers in place.
The technical nature of this flaw allows for exploitation by an attacker who does not possess valid credentials but has network connectivity to the affected system through standard web protocols. The absence of required authentication checks at specific endpoints within the Product Quality Management module enables malicious actors to interact directly with underlying data structures. This lack of proper access control verification means that sensitive queries or manipulation commands can be executed without prior identity validation, effectively bypassing the intended security boundaries established by the application architecture.
Successful exploitation leads to substantial unauthorized access to critical business information stored within the Oracle Agile environment. Attackers can extract confidential product specifications, quality metrics, and proprietary manufacturing data, resulting in a high impact on confidentiality. Furthermore, the vulnerability permits unauthorized modifications to this data, including updates, inserts, or deletions. This capability compromises the integrity of the system by allowing adversaries to alter records, inject false information, or remove essential entries, which can disrupt operational workflows and lead to incorrect decision-making based on corrupted datasets.
From a classification perspective, this issue aligns with CWE-287, Improper Authentication, as it involves failing to properly verify user identity before granting access to protected resources. It also correlates with CWE-601, URL Redirection to Untrusted Site (Open Redirect), if the exploitation vector relies on manipulating request parameters or headers to bypass security controls, though primarily it reflects a failure in authorization logic often categorized under CWE-862, Missing Authorization. In terms of offensive tactics, this vulnerability facilitates initial access and data exfiltration phases within the MITRE ATT&CK framework, specifically relating to techniques that exploit web application vulnerabilities for unauthorized information discovery or modification.
The operational impact extends beyond immediate data compromise to include potential long-term reputational damage and regulatory non-compliance. Organizations relying on Oracle Agile Product Lifecycle Management must ensure the accuracy of their quality management records; tampering with these records can lead to compliance failures in industries such as pharmaceuticals, automotive, and aerospace where strict adherence to quality standards is mandated by law. Additionally, the ability to delete or corrupt data may cause service disruptions requiring extensive recovery efforts from backups, thereby impacting business continuity.
Mitigation strategies should prioritize immediate patching of Oracle Agile Product Lifecycle Management for Process to version 6.2.4 with all available security updates released after the disclosure of this vulnerability. If patching is not immediately feasible, organizations must implement strict network-level access controls by restricting HTTP traffic to only trusted IP addresses or internal subnets using firewalls and intrusion prevention systems. Enforcing HTTPS exclusively eliminates the risk associated with unencrypted transmission and can be paired with Web Application Firewalls configured to detect and block anomalous request patterns indicative of exploitation attempts for this specific component. Regular security audits and penetration testing should also be conducted to verify that authentication mechanisms are correctly enforced across all application endpoints.