CVE-2026-91624 is a critical (CVSS 9.1) vulnerability in Oracle Agile Product Lifecycle Management for Process 6.2.4 that lets an unauthenticated attacker read, create, modify, or delete critical application data over HTTP.
What Is It
CVE-2026-91624 affects the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process, part of Oracle Supply Chain. Oracle describes it as "easily exploitable." An unauthenticated attacker who can reach the application over HTTP can compromise it.
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) breaks down as:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Impact: High confidentiality, high integrity, no availability impact
Why It Matters
If exploited, an attacker can gain unauthorized access to critical data, or to all data the application can reach. They can also create, delete, or modify that data. Product lifecycle and quality management systems often hold sensitive product specifications, formulations, and quality records. A flaw that needs no login and no user interaction is a serious risk to data confidentiality and integrity.
NVD lists the exploitability subscore as 3.9 and the impact subscore as 5.2.
Exploitation status: CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE, so active exploitation is not confirmed in the supplied data. There is also no KEV-mandated remediation deadline.
NVD lists the record as "Received" (published 2026-10-20), so NVD has not yet completed its own analysis. The severity data above comes from Oracle as the CNA.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Agile Product Lifecycle Management for Process
- Component: Product Quality Management
- Affected supported version: 6.2.4
The NVD record does not list any CPE entries.
Patch Status
The vulnerability is referenced in Oracle's October 2026 Critical Patch Update security alert. The supplied NVD data does not give specific fixed versions or patch identifiers.
Organizations running version 6.2.4 should:
- Review the Oracle advisory below and apply the fixes it provides.
- Prioritize systems reachable over HTTP from untrusted networks, given the low attack complexity and the fact that no authentication is needed.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-91624
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)