{"id":"CVE-2026-91521","kind":"vulnerability","aliases":["CVE-2026-91521"],"related":[],"title":"Oracle Agile PLM for Process: low-privilege network attacker takes over server","description":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Agile PLM for Process 6.2.4 (Product Quality Management component) has a flaw that lets a low-privilege authenticated attacker with HTTP access take over the product. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update.","severity":"high","cvss":8.8,"epss":0.00328,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Agile Product Lifecycle Management for Process","fixed":[],"affected":"6.2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle","oracle agile plm","oracle-agile-plm","other","package","product quality management","self-hosted","supply-chain"],"not_affected_if":["default-config"],"how_to_check":"Check whether you run Oracle Agile Product Lifecycle Management for Process 6.2.4 (the only affected version listed). Then check whether the Oct 2026 CPU patch from the Supply Chain Products patch availability document in My Oracle Support is applied. Oracle's public pages do not name a file or setting.","fix":"Apply the October 2026 Oracle Critical Patch Update for Oracle Agile PLM for Process. The patch number is in the Oracle Supply Chain Products patch availability document (My Oracle Support); Oracle's public advisory gives no fixed version. No official workaround. Until patched, limit HTTP access to the application to trusted networks and accounts.","status":"open","published_at":"2026-10-20T22:20:56+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:52+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Agile PLM for Process: low-privilege network attacker takes over server","impact":"high","summary":"Oracle Agile Product Lifecycle Management for Process version 6.2.4 has a flaw in its Product Quality Management component. An attacker with a low-privilege account and network access over HTTP can fully take over the product.","category":"package","who_cares":["oracle agile plm","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the server, reading and changing all data","analyst_note":"Find Oracle's Critical Patch Update advisory for the patch version and any workaround; the NVD entry does not name a fixed version.","how_to_check":"Confirm whether you run Oracle Agile PLM for Process 6.2.4 (the sources do not give a file or setting to check).","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00049,"input_tokens":3090,"output_tokens":362,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patch version and any workaround; the NVD entry does not name a fixed version.","search":"'-2026':15A,18A '-91521':16A,19A '/av':169C '2026':86B '3.1':75B,156C,168C '6.2.4':51B,116C '8.8':76B,159C 'access':69B,126C 'affect':114C 'agil':2A,29B,33B,47B,94C,132C,149C 'agile':21A 'allow':120C 'attack':10A,66B,123C,139C 'authent':65B 'av':77B 'avail':163C 'base':157C 'chain':45B,104C 'compon':55B,105C 'compromis':130C 'confidenti':160C 'critic':87B 'cve':14A,17A 'cvss':74B,155C,165C,167C 'easili':117C 'exploit':118C 'fix':82B 'flaw':58B 'for':25A 'h':177C 'h/a':176C 'h/i':175C 'host':42B 'http':68B,128C 'impact':164C 'integr':161C 'l/pr':79B,171C 'l/ui':80B,172C 'let':60B 'lifecycl':96C,134C,151C 'lifecycle':23A 'low':7A,63B,121C 'low-privileg':6A,62B 'manag':39B,54B,97C,108C,135C,152C 'management':24A 'n':81B 'n/ac':78B,170C 'n/s':173C 'network':9A,125C 'octob':85B 'oracl':1A,27B,28B,32B,46B,93C,102C,131C,148C 'oracle':20A 'oracle-agile-plm':31B 'packag':36B 'patch':88B 'plm':3A,30B,34B,48B 'privileg':8A,64B,122C 'process':5A,26A,50B,99C,137C,154C 'product':22A,37B,52B,73B,95C,100C,106C,133C,150C 'qualiti':38B,53B,107C 'result':144C 'score':158C 'self':41B 'self-host':40B 'server':13A 'success':138C 'suppli':44B,103C 'supply-chain':43B 'support':110C 'take':11A,70B 'takeov':146C 'u/c':174C 'updat':89B 'vector':166C 'version':111C 'via':127C 'vulner':90C,119C,142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91521","severity":null,"published_at":"2026-10-20T22:20:56+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91521:540","url":null,"severity":null,"published_at":"2026-10-23T23:53:03+00:00","modified_at":"2026-10-23T23:53:03+00:00","first_seen_at":"2026-10-23T23:53:03+00:00","fetched_at":"2026-10-23T23:53:03+00:00","note":"Oracle CPU Oct 2026 (2026-10-20) lists Agile PLM for Process 6.2.4 with patch via the Oracle Supply Chain Products patch availability doc (MOS, login needed; not read). No fixed version number, no workaround published by Oracle. No PoC or exploitation found; no X posts."},{"source":"epss","external_id":"CVE-2026-91521","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91521","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2219,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91521","title":"CVE Record: CVE-2026-91521","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}