--- id: "CVE-2026-91622" kind: "vulnerability" aliases: ["CVE-2026-91622"] title: "Oracle Agile PLM: unauthenticated attacker can modify and delete critical data" severity: "critical" cvss: 9.3 epss: 0.00237 exploited: false status: "open" category: "other" products: [{"name": "Oracle Agile Product Lifecycle Management for Process", "fixed": [], "affected": "6.2.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["oracle-agile-plm", "other", "product-lifecycle-management", "product-quality-management", "self-hosted"] not_affected_if: ["not-running-agile-plm-for-process-6.2.4", "versions-other-than-6.2.4"] published_at: "2026-10-20T22:21:02+00:00" first_seen_at: "2026-10-23T21:57:27+00:00" updated_at: "2026-10-24T13:15:55+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91622", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:56:19+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91622", "first_seen_at": "2026-10-24T13:15:55+00:00"}] --- # Oracle Agile PLM: unauthenticated attacker can modify and delete critical data Oracle Agile Product Lifecycle Management for Process 6.2.4, Product Quality Management component: an unauthenticated attacker over HTTP can, if another person interacts (UI:R, e.g. a malicious link), create, modify or delete critical data and read all data the product can access. Scope changes, so other products can be affected. CVSS 3.1 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Fixed in Oracle's October 2026 Critical Patch Update. Oracle names 6.2.4 as the only affected supported version; older unsupported releases are not assessed. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Oracle Agile Product Lifecycle Management for Process affected 6.2.4 fixed ? ## How to check Find out whether Oracle Agile PLM for Process is installed and which version it is (6.2.4 is the affected one). Check whether its web interface is reachable from untrusted networks or by users who could be sent a link. Then check whether the October 2026 CPU patch for Supply Chain Products (per the MOS patch availability document) is applied. ## Fix Apply the Oracle October 2026 Critical Patch Update for Oracle Supply Chain Products (Agile PLM for Process 6.2.4) using the patch availability document on My Oracle Support. Oracle publishes no fixed version number and no workaround. Until patched, restrict network access to the application and warn users about links to it. ## Timeline - 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91622 - 2026-10-23T22:56:19+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists Agile PLM for Process 6.2.4 as the only affected version for this CVE; patch is via the Oracle Supply Chain Products patch availability doc on My Oracle Support (login needed, not read), so exact patch id unknown. No workaround published. No exploitation or PoC found; not in KEV. Did not search social posts (no conversation by CVE id in results). - 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91622 ## Documents - [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html - [describes] CVE Record: CVE-2026-91622 https://www.cve.org/CVERecord?id=CVE-2026-91622 - [mentions] Oracle October 2026 CPU: 34 Critical CVEs https://cveo.tech/blog/oracle-october-2026-cpu-34-critical-cves-soa-suite-java-en ## From the sources Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_