---
id: "CVE-2026-91624"
kind: "vulnerability"
aliases: ["CVE-2026-91624"]
title: "Oracle Agile PLM for Process: unauthenticated network flaw lets attackers alter data"
severity: "critical"
cvss: 9.1
epss: 0.00249
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Agile Product Lifecycle Management for Process", "fixed": [], "affected": "6.2.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["manufacturing", "oracle", "oracle-agile-plm", "other", "product-quality", "self-hosted", "supply-chain"]
not_affected_if: ["not-version-6.2.4"]
published_at: "2026-10-20T22:21:02+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91624", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:55:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91624", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Agile PLM for Process: unauthenticated network flaw lets attackers alter data

Oracle Agile Product Lifecycle Management for Process, in its Product Quality Management component, has a flaw that an unauthenticated attacker can reach over HTTP. A successful attack can create, change or delete critical data and read all data the product holds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Agile Product Lifecycle Management for Process affected 6.2.4 fixed ?

## How to check

Check whether you run Oracle Agile Product Lifecycle Management for Process version 6.2.4 (Product Quality Management component) and whether its HTTP interface is reachable from untrusted networks. Then check whether the October 2026 CPU patch for Oracle Supply Chain Products is applied. Look up the patch in the MOS patch availability document.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Oracle Supply Chain Products (Agile PLM for Process). The exact patch number or fixed version is in the MOS document and is not public. Until patched, restrict network access to the application.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91624
- 2026-10-23T22:55:28+00:00 analyst — Oracle's October 2026 CPU (published 2026-10-20) lists Agile PLM for Process 6.2.4 and points to the Oracle Supply Chain Products patch availability doc. That doc is on My Oracle Support behind login, so the fixed version and any workaround are unknown. No exploitation or PoC found; social search not run.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91624

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mentions] Strix: CVE-2026-91624 https://www.strix.ai/cve/CVE-2026-91624

## From the sources

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_