How do I check whether I am affected by CVE-2026-91622?

Find out whether Oracle Agile PLM for Process is installed and which version it is (6.2.4 is the affected one). Check whether its web interface is reachable from untrusted networks or by users who could be sent a link. Then check whether the October 2026 CPU patch for Supply Chain Products (per the MOS patch availability document) is applied.

What is the fix for CVE-2026-91622?

Apply the Oracle October 2026 Critical Patch Update for Oracle Supply Chain Products (Agile PLM for Process 6.2.4) using the patch availability document on My Oracle Support. Oracle publishes no fixed version number and no workaround. Until patched, restrict network access to the application and warn users about links to it.

Who is not affected by CVE-2026-91622?

Not affected if: not-running-agile-plm-for-process-6.2.4, versions-other-than-6.2.4.

Live › vulnerability › CVE-2026-91622

Go to dashboard

critical9.3Other

Oracle Agile PLM: unauthenticated attacker can modify and delete critical data

Oracle Agile Product Lifecycle Management for Process 6.2.4, Product Quality Management component: an unauthenticated attacker over HTTP can, if another person interacts (UI:R, e.g. a malicious link), create, modify or delete critical data and read all data the product can access. Scope changes, so other products can be affected. CVSS 3.1 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Fixed in Oracle's October 2026 Critical Patch Update. Oracle names 6.2.4 as the only affected supported version; older unsupported releases are not assessed.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.2% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker deletes or modifies critical data, reaching other connected products.
CVSS said: 9.3. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91622

Go to dashboard

critical9.3Other

Oracle Agile PLM: unauthenticated attacker can modify and delete critical data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.2% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker deletes or modifies critical data, reaching other connected products.
CVSS said: 9.3. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle Agile PLM: unauthenticated attacker can modify and delete critical data

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Agile PLM: unauthenticated attacker can modify and delete critical data

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources