CVE-2026-91604: Oracle Agile PLM RCE Vulnerability

CVE-2026-91604 Overview

CVE-2026-91604 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management (PLM) for Process, affecting version 6.2.4. The flaw resides in the Product Quality Management component of Oracle Supply Chain. An authenticated attacker with low privileges and network access over HTTP can compromise the application. Successful exploitation results in full takeover of the Oracle Agile PLM for Process instance, impacting confidentiality, integrity, and availability. Oracle addressed the vulnerability in its October 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants attackers complete takeover of Oracle Agile PLM for Process, exposing sensitive product lifecycle, quality, and supply chain data to unauthorized modification or disclosure.

Affected Products

Oracle Agile Product Lifecycle Management for Process 6.2.4
Oracle Supply Chain — Product Quality Management component
Deployments exposing the PLM HTTP interface to authenticated users

Discovery Timeline

2026-10-20 - CVE-2026-91604 published to NVD
2026-10-21 - Last updated in NVD database
October 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-91604

Vulnerability Analysis

The vulnerability resides in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. An attacker with valid low-privileged credentials can send crafted HTTP requests to the application. Although Oracle classifies the vulnerability as difficult to exploit, successful attacks compromise all three security properties of the application. The impact extends to full product takeover, meaning the attacker gains control over PLM data, workflows, and administrative functions tied to quality management processes.

Oracle has not disclosed low-level technical details, consistent with its Critical Patch Update policy. The vendor notes attack complexity is high, suggesting exploitation depends on specific preconditions such as timing, environment configuration, or chained conditions that must be satisfied by the attacker.

Root Cause

Oracle did not publish a CWE classification or detailed root cause for CVE-2026-91604. The advisory confirms the defect exists within the Product Quality Management module, is reachable over HTTP, and requires authentication. The combination of network reach, authenticated access, and high impact on confidentiality, integrity, and availability indicates a server-side logic or authorization flaw that permits privilege boundaries to be crossed from a low-privileged role.

Attack Vector

Exploitation requires network access to the Oracle Agile PLM for Process HTTP interface and valid low-privileged credentials. No user interaction is required. The attacker issues crafted requests to the Product Quality Management component to escalate privileges and seize control of the application. Internet-exposed PLM deployments and environments with weak internal segmentation are at elevated risk because initial credential acquisition through phishing or credential reuse becomes a direct pathway to full takeover.

No public proof-of-concept exploit, exploit database entry, or CISA KEV listing is currently associated with this CVE. See the Oracle Critical Patch Update advisory for vendor-published details.

Detection Methods for CVE-2026-91604

Indicators of Compromise

Unexpected administrative or configuration changes within the Product Quality Management module performed by low-privileged accounts.
Anomalous HTTP request patterns to Oracle Agile PLM for Process endpoints, especially repeated requests from a single authenticated session targeting quality management functions.
New or modified privileged accounts, workflows, or scheduled tasks within the PLM application following authenticated low-privilege sessions.

Detection Strategies

Review application and web server logs for authenticated sessions that transition from standard user activity to administrative actions without an intervening privilege change.
Correlate HTTP access logs with PLM audit logs to identify requests that produce administrative-level outcomes from low-privileged roles.
Baseline normal Product Quality Management workflows and alert on deviations in request volume, parameters, or response codes.

Monitoring Recommendations

Enable verbose audit logging in Oracle Agile PLM for Process and forward logs to a centralized analytics platform for retention and correlation.
Monitor outbound connections from the PLM application server for signs of post-exploitation activity such as data exfiltration or reverse shells.
Track authentication failures and successful logins by low-privileged accounts outside normal business hours or from unusual geolocations.

How to Mitigate CVE-2026-91604

Immediate Actions Required

Apply the Oracle October 2026 Critical Patch Update to Oracle Agile Product Lifecycle Management for Process 6.2.4 without delay.
Inventory all Oracle Agile PLM for Process deployments, including test and staging environments, and confirm patch status for each instance.
Rotate credentials for low-privileged PLM accounts and enforce strong authentication, including multi-factor authentication where supported.

Patch Information

Oracle addressed CVE-2026-91604 in the October 2026 Critical Patch Update. Administrators should download and deploy the applicable patch for Oracle Agile PLM for Process 6.2.4 directly from Oracle Support. Full remediation details are available in the Oracle Critical Patch Update advisory. Oracle recommends applying Critical Patch Updates as soon as they are released.

Workarounds

Restrict HTTP access to the Oracle Agile PLM for Process application using network segmentation, VPN, or allowlisted source IP ranges.
Review and tighten role-based access control to minimize the number of accounts with any level of PLM access.
Place a web application firewall in front of the PLM interface and inspect requests to the Product Quality Management component for anomalous parameters.

bash

# Example: restrict access to Oracle Agile PLM HTTP endpoint via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP