{"id":"CVE-2026-91520","kind":"vulnerability","aliases":["CVE-2026-91520"],"related":[],"title":"Oracle Agile PLM for Process: low-privilege HTTP attacker can take over server","description":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Agile PLM for Process 6.2.4 (Product Quality Management component) has a flaw that lets a low-privilege user with HTTP access take over the product (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update. No public exploitation or PoC found.","severity":"high","cvss":8.8,"epss":0.00447,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Agile Product Lifecycle Management for Process","fixed":["October 2026 CPU patch (id in MOS note)"],"affected":"6.2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise","oracle","oracle-agile-plm","other","package","self-hosted"],"not_affected_if":["not-running-6.2.4","other-versions"],"how_to_check":"Check whether you run Oracle Agile Product Lifecycle Management for Process 6.2.4 (the only affected version Oracle lists), and whether the October 2026 CPU patch is applied. The patch level is in the Oracle Supply Chain Products patch availability document (My Oracle Support login needed). Also check whether the web client is reachable from untrusted networks.","fix":"Apply the October 2026 Oracle Critical Patch Update for Oracle Supply Chain Products (Agile PLM for Process 6.2.4) as described in the MOS patch availability document. No workaround is published. Exact patch number: unknown, needs the MOS note. Until patched, keep the web client off the internet (VPN) and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:56+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:53+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Agile PLM for Process: low-privilege HTTP attacker can take over server","impact":"high","summary":"Oracle Agile Product Lifecycle Management for Process version 6.2.4, in the Product Quality Management component, lets a low-privilege user reach it over HTTP and compromise it. A successful attack can take over the whole product, with full confidentiality, integrity and availability impact.","category":"package","who_cares":["oracle-agile-plm","enterprise","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the product, reads and changes all data","analyst_note":"Check Oracle Critical Patch Update advisory for the patch level and workaround for Agile PLM for Process 6.2.4; the NVD entry lacks them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000491,"input_tokens":3092,"output_tokens":363,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle Critical Patch Update advisory for the patch level and workaround for Agile PLM for Process 6.2.4; the NVD entry lacks them.","search":"'-2026':16A,19A '-91520':17A,20A '/av':167C '2026':78B '3.1':67B,154C,166C '6.2.4':44B,114C '8.8':68B,157C 'access':61B,124C 'affect':112C 'agil':2A,32B,40B,92C,130C,147C 'agile':22A 'allow':118C 'attack':10A,121C,137C 'av':69B 'avail':161C 'base':155C 'chain':102C 'compon':48B,103C 'compromis':128C 'confidenti':158C 'critic':79B 'cve':15A,18A 'cvss':66B,153C,163C,165C 'easili':115C 'enterpris':28B 'exploit':84B,116C 'fix':74B 'flaw':51B 'for':26A 'found':87B 'h':175C 'h/a':174C 'h/i':173C 'host':38B 'http':9A,60B,126C 'impact':162C 'integr':159C 'l/pr':71B,169C 'l/ui':72B,170C 'let':53B 'lifecycl':94C,132C,149C 'lifecycle':24A 'low':7A,56B,119C 'low-privileg':6A,55B 'manag':47B,95C,106C,133C,150C 'management':25A 'n':73B 'n/ac':70B,168C 'n/s':171C 'network':123C 'octob':77B 'oracl':1A,29B,31B,39B,91C,100C,129C,146C 'oracle':21A 'oracle-agile-plm':30B 'packag':35B 'patch':80B 'plm':3A,33B,41B 'poc':86B 'privileg':8A,57B,120C 'process':5A,27A,43B,97C,135C,152C 'product':23A,45B,65B,93C,98C,104C,131C,148C 'public':83B 'qualiti':46B,105C 'result':142C 'score':156C 'self':37B 'self-host':36B 'server':14A 'success':136C 'suppli':101C 'support':108C 'take':12A,62B 'takeov':144C 'u/c':172C 'updat':81B 'user':58B 'vector':164C 'version':109C 'via':125C 'vulner':88C,117C,140C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91520","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91520","severity":null,"published_at":"2026-10-20T22:20:56+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91520:541","url":null,"severity":null,"published_at":"2026-10-23T23:54:10+00:00","modified_at":"2026-10-23T23:54:10+00:00","first_seen_at":"2026-10-23T23:54:10+00:00","fetched_at":"2026-10-23T23:54:10+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists Agile PLM for Process 6.2.4 as affected; patch number is in a My Oracle Support note behind login, so exact patch id unknown. CVE.org gives CVSS 8.8, CWE-269 (VulDB). No exploitation or PoC found; x-cli count 0."},{"source":"epss","external_id":"CVE-2026-91520","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91520","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2230,"url":"https://cadchain.com/tpost/oracle-agile-plm-vulnerabilities","title":"Oracle Agile PLM Vulnerabilities: Oct 2026 Patch (CADChain)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2231,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91520","title":"CVE Record: CVE-2026-91520","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}