CVE-2026-21969

Critical

Published: 20/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Vulnerability in Oracle Agile Product Lifecycle Management for Process (component: Supplier Portal) version 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks can result in takeover of Oracle Agile PLM for Process. CVSS 3.1 Base Score 9.8.

Risk Assessment

An attacker can fully take over the Oracle Agile PLM system, potentially leading to loss of confidentiality, integrity, and availability of data and disruption of product lifecycle management processes.

Recommendation

Apply patches provided by Oracle or restrict network access to the system to minimize risk.

Original NVD description (English source)

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).