CVE-2026-91521: Oracle Agile PLM for Process RCE Vulnerability

CVE-2026-91521 Overview

CVE-2026-91521 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management (PLM) for Process, specifically within the Product Quality Management component. The affected version is 6.2.4. An authenticated attacker with low privileges and network access over HTTP can exploit this flaw to compromise the application. Successful exploitation results in full takeover of Oracle Agile PLM for Process, with impacts across confidentiality, integrity, and availability. Oracle addressed the issue in the October 2026 Critical Patch Update.

Critical Impact

An authenticated low-privilege attacker can take over Oracle Agile PLM for Process via a network-reachable HTTP interface, exposing product data and halting business operations.

Affected Products

• Oracle Agile Product Lifecycle Management for Process 6.2.4
• Component: Product Quality Management
• Oracle Supply Chain product family

Discovery Timeline

• 2026-10-20 - CVE-2026-91521 published to NVD
• 2026-10-21 - Last updated in NVD database
• October 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-91521

Vulnerability Analysis

The vulnerability resides in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. Oracle classifies the flaw as easily exploitable, requiring only low privileges and network access over HTTP. No user interaction is required to trigger the condition. Successful exploitation yields complete takeover of the application, meaning an attacker can read, modify, or destroy quality management records and related product data.

Oracle has not publicly disclosed the underlying weakness class or CWE identifier. The combination of network reachability, low privilege requirements, and full tri-impact outcome is consistent with an authenticated injection or broken access control flaw in an HTTP-facing module. Organizations using Agile PLM to manage regulated product data should treat the issue as a priority remediation item.

Root Cause

Oracle has not published root-cause details for CVE-2026-91521 beyond the component identification. The advisory confirms the issue is reachable through standard HTTP interactions against the Product Quality Management component. Refer to the Oracle Critical Patch Update advisory for vendor-provided technical references.

Attack Vector

The attack vector is network-based. An attacker must hold a valid low-privilege account on the target Oracle Agile PLM for Process instance. From there, the attacker sends crafted HTTP requests to the Product Quality Management component. No social engineering or victim interaction is required. Because the scope is unchanged and all three CIA impacts are high, the attacker can pivot from an unprivileged user context to full application compromise within a single authenticated session.

No public proof-of-concept, Exploit-DB entry, or CISA KEV listing is associated with this CVE at publication time.

Detection Methods for CVE-2026-91521

Indicators of Compromise

• Unexpected HTTP requests from low-privilege user sessions targeting Product Quality Management endpoints.
• Creation, modification, or deletion of quality records by accounts that do not normally perform those actions.
• New or elevated application roles granted outside of change-management windows.
• Anomalous outbound connections or file writes from the Oracle Agile PLM application server.

Detection Strategies

• Enable verbose application and web-server logging for the Product Quality Management module and forward logs to a centralized analytics platform.
• Baseline normal HTTP request patterns per user role and alert on deviations such as atypical parameters, verbs, or request volumes.
• Correlate authentication events with privileged administrative actions to surface low-privilege accounts performing high-impact changes.

Monitoring Recommendations

• Monitor the Oracle Agile PLM application server process tree for unexpected child processes or shell invocations.
• Track configuration and schema changes within the PLM database and alert on direct writes outside the application tier.
• Review network flow data for east-west traffic from the PLM host to internal systems that it does not normally contact.

How to Mitigate CVE-2026-91521

Immediate Actions Required

• Apply the October 2026 Oracle Critical Patch Update for Oracle Agile PLM for Process 6.2.4 without delay.
• Inventory all Agile PLM for Process instances, including non-production and disaster-recovery environments, and confirm patch status.
• Restrict HTTP access to the application to trusted network segments and authenticated VPN users.
• Review and reduce low-privilege account exposure, enforcing least privilege on Product Quality Management roles.

Patch Information

Oracle shipped the fix as part of the October 2026 Critical Patch Update. Review the Oracle Critical Patch Update advisory for the specific patch identifiers, prerequisites, and installation guidance applicable to Oracle Agile PLM for Process 6.2.4.

Workarounds

• Place the Agile PLM for Process web tier behind a web application firewall and block anomalous requests to Product Quality Management URIs.
• Temporarily disable or restrict access to the Product Quality Management component for users who do not require it until patching is complete.
• Rotate credentials for low-privilege application accounts and require multi-factor authentication at the identity provider for all PLM access.

# Example: restrict HTTP access to the Agile PLM web tier using iptables
# Allow only the corporate application subnet (10.10.20.0/24) to reach TCP/443
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP