CVE-2026-21969

critical · 9.8

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

9.8

CVSS

0.5%

EPSS (exploit prob.)

41st

EPSS percentile

2026-01-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
oracle	agile_product_lifecycle_management_for_process	6.2.4

Check a specific version with /api/v1/cve/match.

References

https://www.oracle.com/security-alerts/cpujan2026.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-21969