CVE-2026-91622 is a critical (CVSS 9.3) flaw in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process 6.2.4. An unauthenticated remote attacker can use it to read, create, change or delete critical data, but a user other than the attacker has to take some action for the attack to work.
What Is It
The flaw is in Oracle Agile Product Lifecycle Management for Process, part of Oracle Supply Chain, in the Product Quality Management component. Oracle calls it "easily exploitable." An attacker with network access over HTTP can compromise the product without logging in. The attack only works if a person other than the attacker interacts with it.
NVD lists the record as "Received," published 2026-10-20. Oracle ([email protected]) is the source.
Why It Matters
- Severity: CVSS 3.1 Base Score 9.3, rated CRITICAL
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - No credentials needed: network-reachable over HTTP, low attack complexity, no privileges required
- Scope change: the flaw is in Agile PLM for Process, but a successful attack may significantly affect other products
- Impact: a successful attack can give unauthorized create, delete or modify access to critical data or to all data the product can access. It can also give unauthorized access to critical data or complete access to all of that data. Confidentiality and integrity impact are both rated High. Availability impact is None.
The Exploitability subscore is 2.8 and the Impact subscore is 5.8. The main limit on exploitation is the need for user interaction (UI:R).
Exploitation status: CVE-2026-91622 is not in the supplied CISA KEV data. KEV does not confirm active exploitation as of this writing.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| Oracle Corporation | Oracle Agile Product Lifecycle Management for Process | Product Quality Management | 6.2.4 |
Oracle says 6.2.4 is the affected supported version. The NVD record does not list any CPEs yet.
Patch Status
Oracle's security alert for October 2026 is the only reference in the NVD record. Organizations running Agile PLM for Process 6.2.4 should check that advisory for the fix and apply it.
The source data includes no CISA KEV entry, so no federal remediation deadline or required action has been issued. Until the update is applied, keep in mind that the attack needs user interaction and comes in over HTTP. Limiting network exposure of the application lowers risk.
Sources
- NVD, CVE-2026-91622
- Oracle Security Alert; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)