External risk intelligence

Oracle Agile Product Lifecycle Management for Process CVSS 9.3 Vulnerability Allows Data Tampering and Access

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-91622

The product is an enterprise Product Lifecycle Management (PLM) system. While network-accessible via HTTP, these applications are typically deployed within internal corporate networks or behind VPNs to manage sensitive proprietary data, rather than being exposed as public-facing internet services.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle's Product Lifecycle Management for Process software, which is used for managing product quality. This issue is exploitable remotely by unauthenticated attackers and, if exploited, could lead to unauthorized access or modification of critical data within the system. The main concern at this time is to confirm if our organization uses this specific product and is therefore exposed.

Unauthenticated attackers can alter or access critical data.
Confirms relevance and potential exposure in product management.
Prioritize confirming use and assessing potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could target an unauthenticated user on the network by sending them a malicious link or document, which, if interacted with, could allow them to modify or access critical data within Oracle Agile Product Lifecycle Management for Process and potentially other connected products.

Attacker needs network access.
Trigger requires user interaction with malicious content.
Unauthorized data access and modification is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to alter or gain complete access to critical and all accessible data within Oracle Agile Product Lifecycle Management for Process, potentially impacting other connected Oracle products. The attack requires user interaction and can lead to unauthorized modifications or complete data compromise.

Critical product data could be at risk.
Network access and user interaction enable exposure.
Unauthorized data modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle Agile Product Lifecycle Management for Process likely falls under the responsibility of the application owner, with potential involvement from infrastructure and security teams. The first practical step is to identify all instances of the affected product, determine their business criticality and network reachability, and then confirm the accountable owner to plan a risk-based remediation strategy.

Application owner to manage the issue.
Verify network exposure and criticality.
Plan and coordinate remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Agile Product Lifecycle Management for Process?

This software is an enterprise-grade platform used by organizations to manage the entire lifecycle of a product, from initial design and development to quality control. It acts as a central repository for sensitive specifications, compliance data, and quality management workflows, helping companies maintain product consistency and regulatory adherence within their supply chain operations.

What does this CVE-2026-91622 vulnerability actually mean?

This flaw allows an attacker to gain unauthorized control over data within the system. It is classified as an issue where improper control mechanisms fail to prevent illegitimate actions. In this specific case, an attacker can manipulate, delete, or steal critical information, potentially impacting not just this software but also other integrated systems connected to it.

How is this vulnerability triggered?

The attack path requires the targeted user to perform an action, such as clicking a malicious link or interacting with a deceptive document provided by an attacker. It is important to note that simply having the software reachable over a network is not enough on its own; the exploit relies on this human-element trigger to successfully gain unauthorized access.

Do I need to worry if my system is internal?

According to Halo Surface Signal, this software is typically housed within internal corporate networks or behind VPNs to protect proprietary data rather than being exposed to the public internet. However, since the attack requires network access, it remains a concern for any internal user who could be tricked by a malicious link, making it a relevant risk for internal infrastructure.

What is the first step to address CVE-2026-91622?

Your priority should be to identify every instance of version 6.2.4 running in your environment. Once identified, work with the specific application owners to determine the business criticality of those instances and evaluate their current network accessibility. This information will help your team establish a focused, risk-based plan to manage the vulnerability.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.