{"id":"CVE-2026-91622","kind":"vulnerability","aliases":["CVE-2026-91622"],"related":[],"title":"Oracle Agile PLM: unauthenticated attacker can modify and delete critical data","description":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).","summary":"Oracle Agile Product Lifecycle Management for Process 6.2.4, Product Quality Management component: an unauthenticated attacker over HTTP can, if another person interacts (UI:R, e.g. a malicious link), create, modify or delete critical data and read all data the product can access. Scope changes, so other products can be affected. CVSS 3.1 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Fixed in Oracle's October 2026 Critical Patch Update. Oracle names 6.2.4 as the only affected supported version; older unsupported releases are not assessed.","severity":"critical","cvss":9.3,"epss":0.00237,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Agile Product Lifecycle Management for Process","fixed":[],"affected":"6.2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle-agile-plm","other","product-lifecycle-management","product-quality-management","self-hosted"],"not_affected_if":["not-running-agile-plm-for-process-6.2.4","versions-other-than-6.2.4"],"how_to_check":"Find out whether Oracle Agile PLM for Process is installed and which version it is (6.2.4 is the affected one). Check whether its web interface is reachable from untrusted networks or by users who could be sent a link. Then check whether the October 2026 CPU patch for Supply Chain Products (per the MOS patch availability document) is applied.","fix":"Apply the Oracle October 2026 Critical Patch Update for Oracle Supply Chain Products (Agile PLM for Process 6.2.4) using the patch availability document on My Oracle Support. Oracle publishes no fixed version number and no workaround. Until patched, restrict network access to the application and warn users about links to it.","status":"open","published_at":"2026-10-20T22:21:02+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:48+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:33:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle security update for CVE-2026-91622; the sources do not name the patched version.","reach":"network","title":"Oracle Agile PLM: unauthenticated attacker can modify and delete critical data","impact":"high","summary":"Oracle Agile Product Lifecycle Management for Process 6.2.4 has a flaw in its Product Quality Management component that an unauthenticated attacker can reach over HTTP. A successful attack can create, delete or modify critical data and read all data the product can access, and it can also affect other products.","category":"other","who_cares":["oracle-agile-plm","self-hosted","product-lifecycle-management"],"confidence":0.8,"needs_auth":"no","worst_case":"attacker deletes or modifies critical data, reaching other connected products","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91622 to name the patched release; the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-91622 does not name one.","how_to_check":"Confirm whether Oracle Agile PLM for Process version 6.2.4 is deployed and reachable over HTTP.","needs_analyst":true,"not_affected_if":["versions-other-than-6.2.4"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00113,"input_tokens":3227,"output_tokens":1615,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91622 to get the patched version and any workaround, and confirm whether other versions besides 6.2.4 are affected.","search":"'-2026':13A,16A '-91622':14A,17A '/av':270C '2026':108B '3.1':92B,258C,269C '6.2.4':48B,114B,153C '9.3':93B,261C 'access':82B,162C,220C,233C,239C,245C,255C 'addit':203C 'affect':90B,118B,151C 'agil':2A,27B,42B,131C,168C,193C,227C,249C 'agile':19A 'allow':157C 'anoth':60B 'assess':126B 'attack':5A,55B,159C,175C,185C,199C,208C 'av':94B 'base':259C 'c/c':99B,275C 'chain':141C 'chang':84B,206C 'complet':244C 'compon':52B,142C 'compromis':166C 'confidenti':262C 'creat':69B 'creation':216C 'critic':10A,73B,109B,222C,241C 'cve':12A,15A 'cvss':91B,257C,266C,268C 'data':11A,74B,78B,223C,234C,242C,256C 'delet':9A,72B,217C 'e.g':65B 'easili':154C 'exploit':155C 'fix':103B 'for':23A 'h/a':101B,277C 'h/i':100B,276C 'host':40B 'http':57B,164C 'human':177C 'impact':202C,265C 'integr':264C 'interact':62B,178C 'l/pr':96B,272C 'lifecycl':32B,44B,133C,170C,195C,229C,251C 'lifecycle':21A 'link':68B 'malici':67B 'manag':33B,37B,45B,51B,134C,145C,171C,196C,230C,252C 'management':22A 'may':200C 'modif':219C 'modifi':7A,70B 'n':102B,278C 'n/ac':95B,271C 'n/ui':97B,273C 'name':113B 'network':161C 'octob':107B 'older':121B 'oracl':1A,26B,41B,105B,112B,130C,139C,167C,192C,226C,248C 'oracle':18A 'oracle-agile-plm':25B 'patch':110B 'person':61B,181C 'plm':3A,28B 'process':24A,47B,136C,173C,198C,232C,254C 'product':20A,31B,35B,43B,49B,80B,87B,132C,137C,143C,169C,194C,204C,228C,250C 'product-lifecycle-manag':30B 'product-quality-manag':34B 'qualiti':36B,50B,144C 'r':64B 'r/s':98B,274C 'read':76B 'releas':123B 'requir':176C 'result':213C 'scope':83B,205C 'score':260C 'self':39B 'self-host':38B 'signific':201C 'success':174C,207C 'suppli':140C 'support':119B,147C 'ui':63B 'unauthent':4A,54B,158C 'unauthor':215C,238C 'unsupport':122B 'updat':111B 'vector':267C 'version':120B,148C 'via':163C 'vulner':127C,156C,189C,211C 'well':236C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91622","severity":null,"published_at":"2026-10-20T22:21:02+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91622:329","url":null,"severity":null,"published_at":"2026-10-23T22:56:19+00:00","modified_at":"2026-10-23T22:56:19+00:00","first_seen_at":"2026-10-23T22:56:19+00:00","fetched_at":"2026-10-23T22:56:19+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists Agile PLM for Process 6.2.4 as the only affected version for this CVE; patch is via the Oracle Supply Chain Products patch availability doc on My Oracle Support (login needed, not read), so exact patch id unknown. No workaround published. No exploitation or PoC found; not in KEV. Did not search social posts (no conversation by CVE id in results)."},{"source":"epss","external_id":"CVE-2026-91622","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91622","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1689,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91622","title":"CVE Record: CVE-2026-91622","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1690,"url":"https://cveo.tech/blog/oracle-october-2026-cpu-34-critical-cves-soa-suite-java-en","title":"Oracle October 2026 CPU: 34 Critical CVEs","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}