CVE-2026-91520: Oracle Agile PLM for Process RCE Vulnerability

CVE-2026-91520 Overview

CVE-2026-91520 affects Oracle Agile Product Lifecycle Management (PLM) for Process version 6.2.4, specifically the Product Quality Management component. An authenticated attacker with low privileges can exploit the flaw over HTTP to compromise the application. Successful exploitation results in full takeover of the Oracle Agile PLM for Process instance, impacting confidentiality, integrity, and availability.

Oracle disclosed the issue as part of the October 2026 Critical Patch Update advisory. The vulnerability is network-exploitable without user interaction, making exposed deployments attractive targets for lateral movement and data theft within supply chain environments.

Critical Impact
A low-privileged authenticated attacker with HTTP access can take over Oracle Agile PLM for Process 6.2.4, compromising all product quality and supply chain data managed by the system.

Affected Products

Oracle Agile Product Lifecycle Management for Process 6.2.4
Oracle Supply Chain — Product Quality Management component
Oracle Agile PLM for Process deployments reachable via HTTP

Discovery Timeline

2026-10-20 - CVE-2026-91520 published to NVD as part of Oracle Critical Patch Update October 2026
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-91520

Vulnerability Analysis

The vulnerability resides in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process 6.2.4. Oracle's advisory classifies the issue as easily exploitable by a low-privileged attacker with network access over HTTP. The outcome is a full takeover of the Oracle Agile PLM for Process instance, exposing manufacturing specifications, supplier data, and regulated product information.

Oracle has not published detailed root-cause information. The CVSS metrics indicate that successful exploitation does not break out of the vulnerable component's security scope, yet it still yields high impact across confidentiality, integrity, and availability within that scope.

The EPSS score for this issue is 0.447% as of 2026-10-22, reflecting limited observed exploitation activity at the time of disclosure. Supply chain and manufacturing systems remain high-value targets, so defenders should not treat the current EPSS value as a reason to defer patching.

Root Cause

Oracle has not disclosed the specific weakness class. The advisory describes an authenticated flaw in Product Quality Management that allows an authenticated user to perform actions beyond their intended authorization, resulting in application takeover. No CWE identifier has been assigned in the NVD record.

Attack Vector

The attack vector is network-based over HTTP. An attacker needs valid low-privileged credentials for the Oracle Agile PLM for Process application. Once authenticated, the attacker sends crafted HTTP requests to the vulnerable Product Quality Management endpoints to escalate control over the application. No user interaction is required.

Technical details of the exploitation primitive are not public. Refer to the Oracle Security Alert October 2026 for vendor guidance.

Detection Methods for CVE-2026-91520

Indicators of Compromise

Unexpected administrative actions, user role changes, or configuration modifications performed by low-privileged Agile PLM for Process accounts.
Anomalous HTTP POST or PUT requests targeting Product Quality Management endpoints from a single authenticated session.
Creation of new privileged accounts or export of large volumes of product quality records outside normal business workflows.

Detection Strategies

Review Oracle Agile PLM for Process application and audit logs for privilege changes attributable to non-administrative users.
Correlate web server access logs with application audit trails to identify authenticated sessions issuing requests to Product Quality Management functions they would not normally invoke.
Baseline normal API and HTTP request patterns per role, then alert on deviations such as unexpected endpoint access or unusual payload sizes.

Monitoring Recommendations

Forward Oracle Agile PLM for Process logs, web server logs, and database audit logs to a centralized SIEM for correlation and retention.
Monitor outbound network traffic from the Agile PLM for Process application server for anomalous destinations that may indicate data exfiltration.
Alert on failed-then-successful authentication patterns and on reuse of low-privileged credentials from new source IPs.

How to Mitigate CVE-2026-91520

Immediate Actions Required

Apply the fixes included in the Oracle Critical Patch Update October 2026 to all Oracle Agile PLM for Process 6.2.4 deployments.
Inventory all Agile PLM for Process instances, including non-production environments, and confirm patch coverage.
Restrict network access to the Agile PLM for Process web tier to trusted internal networks and VPN users only.
Rotate credentials for low-privileged accounts and enforce multi-factor authentication where supported.

Patch Information

Oracle addressed CVE-2026-91520 in the Critical Patch Update released October 2026. Administrators should consult the Oracle Security Alert October 2026 for the specific patch bundle covering Oracle Agile Product Lifecycle Management for Process 6.2.4 and apply the fix during the next available change window.

Workarounds

Place the Agile PLM for Process application behind a web application firewall and restrict access to the Product Quality Management endpoints by role or source IP.
Reduce the number of accounts with any level of access to Agile PLM for Process until patching is complete.
Enable verbose application and HTTP audit logging to improve post-incident forensics should exploitation occur before patching.

bash

# Example: restrict access to Agile PLM for Process at the reverse proxy
# (Nginx) until the Oracle CPU October 2026 patch is deployed
location /AgilePLM/ {
    allow 10.0.0.0/8;      # internal corporate network
    allow 192.168.50.0/24; # PLM administrator subnet
    deny all;
    proxy_pass http://agile-plm-backend;
}