CVE-2026-101474
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). A low privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability, resulting in unauthorized access to critical data or complete access to all data and unauthorized ability to cause a partial denial of service (partial DOS).
Risk Assessment
An attacker could gain access to critical data and cause partial service unavailability, potentially disrupting operations.
Recommendation
Update Oracle Agile Product Lifecycle Management for Process to the latest version and monitor for unusual activity.
Other vulnerabilities in Oracle Agile Product Lifecycle Management for Process
See all- CVE-2026-101602High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (component: Product Quality Management) affects version 6.2.4. A low-privileged attacker with network access via HTTP can exploit this vulnerability, which requires user interaction, leading to takeover of the application.
- CVE-2026-101596High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (component: Product Quality Management) affects version 6.2.4. A low-privileged attacker with network access via HTTP can easily exploit this vulnerability, leading to takeover of the application.
- CVE-2026-101595Medium
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Supply Chain Relationship Mgmt component) affects version 6.2.4. An easily exploitable network attack by a low-privileged user requires human interaction and can result in unauthorized update, insert or delete access to some data and read access to a subset of data, with possible impact on additional products (scope change).
- CVE-2026-101594High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (component Product Quality Management) version 6.2.4. Easily exploitable by a low-privileged attacker with network access via HTTP, leading to takeover of the system.
- CVE-2026-101592Medium
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affects version 6.2.4. An easily exploitable network attack by a low-privileged user requires human interaction and can result in unauthorized update, insert or delete access to some data and read access to a subset of data, with possible impact on additional products (scope change).
- CVE-2026-101591Medium
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affects version 6.2.4. An easily exploitable network attack by a low-privileged user can result in unauthorized read access to a subset of data.
- CVE-2026-101473High
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) version 6.2.4. A difficult-to-exploit HTTP attack by an unauthenticated attacker can lead to takeover of the component.
- CVE-2026-91624Critical
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affecting version 6.2.4. An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.1.
- CVE-2026-91622Critical
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affecting version 6.2.4. An unauthenticated attacker with network access via HTTP, requiring user interaction, can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.3.
- CVE-2026-61184Critical
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) allows an unauthenticated attacker via HTTP to unauthorizedly create, delete, or modify critical data and gain full access to all data.
Original NVD description (English source)
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS