{"id":"CVE-2026-101596","kind":"vulnerability","aliases":["CVE-2026-101596"],"related":[],"title":"Oracle Agile PLM for Process: low-privilege HTTP flaw allows full takeover","description":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Agile PLM for Process 6.2.4 (Product Quality Management component) has a flaw that a low-privileged authenticated user can exploit over HTTP to take over the product (CVSS 3.1 8.8, C/I/A high). Oracle fixed it in the October 2026 Critical Patch Update. No exploitation in the wild and no public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Agile Product Lifecycle Management for Process","fixed":[],"affected":"6.2.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise","oracle","oracle-agile-plm","package","product-quality-management","self-hosted"],"not_affected_if":["managed-hosting","not-version-6.2.4"],"how_to_check":"Check whether you run Oracle Agile Product Lifecycle Management for Process 6.2.4 (the only version Oracle lists) and whether the October 2026 CPU patch is applied. Check the Oracle Supply Chain Products patch availability document on My Oracle Support (login required).","fix":"Apply the Oracle Critical Patch Update of October 2026 for Oracle Supply Chain Products (Agile PLM for Process 6.2.4). Patch number and any workaround are in the My Oracle Support patch availability document, which needs a login. Restrict HTTP access to the application to trusted users and networks until the patch is applied.","status":"open","published_at":"2026-10-20T22:18:13+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:32:38+00:00","updated_at":"2026-10-24T00:08:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:32:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Agile PLM for Process: low-privilege HTTP flaw allows full takeover","impact":"high","summary":"Oracle Agile Product Lifecycle Management for Process version 6.2.4, in the Product Quality Management component, has a flaw that an authenticated low-privilege user can reach over HTTP. Successful exploitation lets an attacker take over the product, with high impact to confidentiality, integrity and availability.","category":"package","who_cares":["oracle-agile-plm","product-quality-management","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the PLM server and reads or changes all data","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get the patched version and any workaround; the NVD entry does not name a fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-version-6.2.4"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000496,"input_tokens":3071,"output_tokens":377,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get the patched version and any workaround; the NVD entry does not name a fix.","search":"'-101596':16A,19A '-2026':15A,18A '/av':174C '2026':81B '3.1':71B,161C,173C '6.2.4':46B,121C '8.8':72B,164C 'access':131C 'affect':119C 'agil':2A,31B,42B,99C,137C,154C 'agile':21A 'allow':11A,125C 'attack':128C,144C 'authent':59B 'avail':168C 'base':162C 'c/i/a':73B 'chain':109C 'compon':50B,110C 'compromis':135C 'confidenti':165C 'critic':82B 'cve':14A,17A 'cvss':70B,160C,170C,172C 'easili':122C 'enterpris':27B 'exploit':62B,86B,123C 'fix':76B 'flaw':10A,53B 'for':25A 'found':94B 'full':12A 'h':182C 'h/a':181C 'h/i':180C 'high':74B 'host':40B 'http':9A,64B,133C 'impact':169C 'integr':166C 'l/pr':176C 'l/ui':177C 'lifecycl':101C,139C,156C 'lifecycle':23A 'low':7A,57B,126C 'low-privileg':6A,56B 'manag':37B,49B,102C,113C,140C,157C 'management':24A 'n/ac':175C 'n/s':178C 'network':130C 'octob':80B 'oracl':1A,28B,30B,41B,75B,98C,107C,136C,153C 'oracle':20A 'oracle-agile-plm':29B 'packag':33B 'patch':83B 'plm':3A,32B,43B 'poc':93B 'privileg':8A,58B,127C 'process':5A,26A,45B,104C,142C,159C 'product':22A,35B,47B,69B,100C,105C,111C,138C,155C 'product-quality-manag':34B 'public':92B 'qualiti':36B,48B,112C 'result':149C 'score':163C 'self':39B 'self-host':38B 'success':143C 'suppli':108C 'support':115C 'take':66B 'takeov':13A,151C 'u/c':179C 'updat':84B 'user':60B 'vector':171C 'version':116C 'via':132C 'vulner':95C,124C,147C 'wild':89B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101596","severity":null,"published_at":"2026-10-20T22:18:13+00:00","modified_at":"2026-10-21T18:43:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101596:595","url":null,"severity":null,"published_at":"2026-10-24T00:08:23+00:00","modified_at":"2026-10-24T00:08:23+00:00","first_seen_at":"2026-10-24T00:08:23+00:00","fetched_at":"2026-10-24T00:08:23+00:00","note":"Oracle CPU Oct 2026 (2026-10-20) lists Agile PLM for Process 6.2.4 under Oracle Supply Chain Products; patch number is in a MOS doc behind login, so the exact patch ID is unknown. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), CWE-269 per VulDB; no exploitation or public PoC found; no social search done (niche enterprise product)."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2371,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101596","title":"CVE Record: CVE-2026-101596","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}