CVE-2026-101595
MediumCVSS 5.4Summary
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Supply Chain Relationship Mgmt component) affects version 6.2.4. An easily exploitable network attack by a low-privileged user requires human interaction and can result in unauthorized update, insert or delete access to some data and read access to a subset of data, with possible impact on additional products (scope change).
Risk Assessment
A low-privileged attacker can, with user interaction, modify or delete data and read a subset of it, with effects potentially extending beyond this product. Impact on confidentiality and integrity (CVSS 5.4).
Recommendation
Apply Oracle's fix for Agile PLM for Process. Restrict HTTP network access and train users on phishing and interaction with unknown content.
Other vulnerabilities in Oracle Agile Product Lifecycle Management for Process
See all- CVE-2026-101602High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (component: Product Quality Management) affects version 6.2.4. A low-privileged attacker with network access via HTTP can exploit this vulnerability, which requires user interaction, leading to takeover of the application.
- CVE-2026-101596High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (component: Product Quality Management) affects version 6.2.4. A low-privileged attacker with network access via HTTP can easily exploit this vulnerability, leading to takeover of the application.
- CVE-2026-101594High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (component Product Quality Management) version 6.2.4. Easily exploitable by a low-privileged attacker with network access via HTTP, leading to takeover of the system.
- CVE-2026-101592Medium
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affects version 6.2.4. An easily exploitable network attack by a low-privileged user requires human interaction and can result in unauthorized update, insert or delete access to some data and read access to a subset of data, with possible impact on additional products (scope change).
- CVE-2026-101591Medium
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affects version 6.2.4. An easily exploitable network attack by a low-privileged user can result in unauthorized read access to a subset of data.
- CVE-2026-101473High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) version 6.2.4. A difficult-to-exploit HTTP attack by an unauthenticated attacker can lead to takeover of the component.
- CVE-2026-91624Critical
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affecting version 6.2.4. An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.1.
- CVE-2026-91622Critical
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affecting version 6.2.4. An unauthenticated attacker with network access via HTTP, requiring user interaction, can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.3.
- CVE-2026-61184Critical
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) allows an unauthenticated attacker via HTTP to unauthorizedly create, delete, or modify critical data and gain full access to all data.
- CVE-2026-61183Critical
Vulnerability in Oracle Agile Product Lifecycle Management for Process (component: Reporting). Affected version is 6.2.4. Easily exploitable by unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 9.8.
Original NVD description (English source)
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supply Chain Relationship Mgmt). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS