Zero Radar
← feed
CriticalVulnerabilityCVE-2026-91622updated 25 Oct 2026, 18:50 UTC

Oracle Agile PLM for Process: unauthenticated flaw allows data theft and changes

An attacker on the network can reach this Oracle product without logging in and, if someone is tricked into interacting with a crafted request, can read or change sensitive product data. The flaw can also spread impact to other connected sy

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or account needed
  2. 2HTTP requestSent to the Agile PLM web interface
  3. 3User interactionA legitimate user must take an action
  4. 4Product Quality moduleFlaw in Product Quality Management
  5. 5Critical dataRead, changed, or deleted
  6. ResultAttacker reads or alters critical product data

What happened

A critical flaw in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process 6.2.4 is exploitable over HTTP without authentication and requires user interaction; it enables high confidentiality and integrity impact with scope change.

Why it is dangerous: Successful attacks can create, modify, or delete critical data and gain unauthorized access to all data the product can reach, potentially affecting other products. Organizations running Agile PLM for Process for product quality and engineering records are at risk.

Are you affected?

You are affected if you run Oracle Agile Product Lifecycle Management for Process version 6.2.4 and expose it to a network reachable over HTTP.

Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component)

What to do

  1. Check whether you run Oracle Agile PLM for Process version 6.2.4 and where it is reachable from.
  2. Apply the security patch or update from Oracle's Critical Patch Update for this product as soon as it is available; the sources do not state a fixed version.
  3. Until patched, restrict network access to the product to trusted users and networks only.
  4. Monitor logs for unusual HTTP requests and unexpected changes or deletions to quality records.

Timeline

  1. 20 Oct 2026, 22:21 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:21 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-91622 · GHSA-2g88-fgc2-hmpp
CVSS
9.3 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:21 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Agile PLM for Process: unauthenticated flaw allows data theft and changes · Zero Radar