Key points
- CVE-2026-91622 affects Oracle Agile Product Lifecycle Management for Process version 6.2.4.
- The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.3.
- Exploitation requires human interaction but allows unauthenticated network access via HTTP.
Oracle Agile Product Lifecycle Management for Process version 6.2.4 contains a critical vulnerability that allows unauthenticated attackers to compromise the system. The National Vulnerability Database records this issue as CVE-2026-91622. Attackers can exploit this flaw over a network using standard HTTP requests. The vulnerability resides in the Product Quality Management component of the software.
Successful exploitation requires human interaction from a person other than the attacker. Despite this requirement, the flaw allows unauthorized creation, deletion, or modification of critical data. Attackers can also gain complete access to all accessible data within the application. The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.3 to this issue.
Scope and Impact
The vulnerability is classified as having a scope change. This means attacks may significantly impact additional products beyond the initial component. Confidentiality and integrity impacts are rated as high in the CVSS vector. Availability is not impacted according to the scoring. The vector string indicates network access with low complexity and no privileges required.
Affected Environments
Only Oracle Agile Product Lifecycle Management for Process version 6.2.4 is confirmed to be affected. The supported version is explicitly listed in the advisory. Organizations running this specific release are exposed to unauthenticated data manipulation. No other versions are mentioned in the source material. Teams should verify their current deployment version immediately.
Next steps
No patch or fix has been confirmed yet. Administrators should monitor vendor communications for updates. Until a fix is available, teams should limit network access to the application. Reviewing access logs for unusual HTTP activity is recommended. Ensure that only authorized users can interact with the system.
Signals worth monitoring
Teams usually check web server logs for unusual HTTP requests from unknown sources. Look for spikes in data modification events or unexpected deletions. Monitor for unauthorized access attempts to critical data stores. Check whether user sessions show activity without proper authentication tokens. Inspect database integrity reports for sudden changes. Contain affected systems by isolating them from the network. Review firewall rules to restrict unnecessary traffic.
What to do and how to stay safe: Oracle
- Verify if your environment runs Oracle Agile PLM for Process 6.2.4.
- Monitor HTTP traffic for unauthenticated requests to the Product Quality Management component.
- Restrict network access to the application to trusted IP addresses only.
- Watch for unauthorized data modifications or deletions in system logs.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91622?
The National Vulnerability Database rates the flaw as critical with a CVSS 3.1 Base Score of 9.3.
Does exploiting this vulnerability require authentication?
No, the vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system.
Which version of Oracle Agile PLM is affected?
Only version 6.2.4 of Oracle Agile Product Lifecycle Management for Process is confirmed to be affected.
