Zero Radar
← feed
CriticalVulnerabilityCVE-2026-91624updated 25 Oct 2026, 18:50 UTC

Oracle Agile PLM for Process: unauthenticated attackers can read and change data

Someone on the network can reach this Oracle product without logging in and may be able to view, change, or delete the product data it stores. The data at risk is design and quality information for manufacturing.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or account needed
  2. 2HTTP requestSent to the Agile PLM web interface
  3. 3Product Quality flawFlawed component accepts the request
  4. 4Data accessedRecords can be read, changed, or deleted
  5. ResultAttacker reads and alters critical data

What happened

A flaw in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process lets an unauthenticated attacker send HTTP requests that compromise the application, with high confidentiality and integrity impact.

Why it is dangerous: An attacker could create, modify, or delete critical records and access all data the application can reach, which can disrupt product quality and engineering operations. Organizations running this version that expose it to a network are at risk.

Are you affected?

You are affected if you run Oracle Agile Product Lifecycle Management for Process version 6.2.4 and its HTTP interface is reachable from networks an attacker could use.

Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component)

What to do

  1. Check whether you run Oracle Agile PLM for Process version 6.2.4.
  2. Restrict network access to the application so it is not reachable from untrusted networks.
  3. Apply the fix or mitigation from Oracle's Critical Patch Update advisory for this CVE as soon as available.
  4. Review application data and logs for unexpected creation, changes, or deletions.

Timeline

  1. 20 Oct 2026, 22:21 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:21 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-91624 · GHSA-mr8q-v93p-cjwj
CVSS
9.1 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:21 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Agile PLM for Process: unauthenticated attackers can read and change data · Zero Radar