SB20261110214 - Multiple vulnerabilities in Oracle Agile Product Lifecycle Management for Process
Published: November 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 21 vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2026-101473)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
2) Improper input validation (CVE-ID: CVE-2026-91622)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
3) Improper input validation (CVE-ID: CVE-2026-91624)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
4) Improper input validation (CVE-ID: CVE-2026-91520)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
5) Improper input validation (CVE-ID: CVE-2026-91521)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
6) Improper input validation (CVE-ID: CVE-2026-91550)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
7) Improper input validation (CVE-ID: CVE-2026-101594)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
8) Improper input validation (CVE-ID: CVE-2026-101596)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
9) Improper input validation (CVE-ID: CVE-2026-101593)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to compromise the affected system.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to compromise the affected system.
10) Improper input validation (CVE-ID: CVE-2026-91573)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
11) Improper input validation (CVE-ID: CVE-2026-91625)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
12) Improper input validation (CVE-ID: CVE-2026-101591)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.
13) Improper input validation (CVE-ID: CVE-2026-101602)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
14) Improper input validation (CVE-ID: CVE-2026-91515)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
15) Improper input validation (CVE-ID: CVE-2026-91604)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
16) Improper input validation (CVE-ID: CVE-2026-91623)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
17) Improper input validation (CVE-ID: CVE-2026-91512)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote privileged user can exploit this vulnerability to execute arbitrary code.
18) Improper input validation (CVE-ID: CVE-2026-91565)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to read, manipulate or delete data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to read, manipulate or delete data.
19) Improper input validation (CVE-ID: CVE-2026-101474)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to read and manipulate data.
20) Improper input validation (CVE-ID: CVE-2026-101592)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Product Quality Management component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to read and manipulate data.
21) Improper input validation (CVE-ID: CVE-2026-101595)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Supply Chain Relationship Mgmt component in Oracle Agile Product Lifecycle Management for Process. A remote authenticated user can exploit this vulnerability to read and manipulate data.
Remediation
Install update from vendor's website.